Thread by @rootcathacking

I pet a cat today and now my allergies are killing me, so obviously this calls for a follow up of, hey you found some #aws creds, what to do meow:

#cloud #hacking #Recon
👇

Step 1: First you gotta decide if this is more of a lazy space vibe kinda thing (A), or (B) calls for some illegal dirty acidcore and adjust your playlist accordingly:
A:
B: soundcloud.com/pitch1/i-can-h…

next drop the keys in your .aws creds file. I typically name the first set initial and work with the --profile tag in the cli, so I can keep track on were I am. Then check who you are first, with:
aws sts get-caller-identity --profile initial

Now next up there is a lot to look for, permissions, roles, services, ressources etc, today I will just show two basic examples on what to keep an eye out for

EC2 is always interesting, you can look for instances with
aws ec2 describe-instances
but you can also check for instances, which are directly connected to your IAM, via profile association.

from there enumerate further, possible next could be to find a way to connect and try to get metadata out, which could provide a new set of keys. This is an extra topic in itself. You still have beat, still listening?

It is official #aws and #rootcathacking best practice to always listen to good beat and take occasional dance breaks. I'm serious folks!
Then we look at lambda functions, always a good point of pawsible escalation
aws lambda list-functions

Vulnerable lambdas, or the ability to change its code etc, maaaany pawsibilties. Simply put at some point you wanna achieve something like:
…h.execute-api.us-east-2.amazonaws.com/dev/system?cmd…
meaning any way to get a new set of keys, e.g. by reading env
Also a whole topic in itself

You always wanna look for interesting policies. A quick way is just to use iam list-polices, but, you can pipe and filter it, so you can identify aws or custom roles, look at this output. The first one shows your arn:aws:iam:aws <- meaning its an aws policy,

the second one shows ....:iam:NUMBER, meaning its a custom policy and therefore always interesting, you can search for admin synonyms, or interesting names you already discovered, these can be anything, like vault,key,dev, aunt-mary

@threadreaderapp unroll