aws-postexploit

name	aws-postexploit
description	AWS post-exploitation for IAM privilege escalation, data exfiltration, persistence, and operational security via boto3
category	post-exploitation
tags	["aws","cloud","post-exploitation","iam","s3","lambda","ssm","cloudtrail","credential-access","defense-evasion","persistence"]
tech_stack	["aws","boto3","python"]
cwe_ids	["CWE-269","CWE-522","CWE-693","CWE-284"]
chains_with	["T1078.004","T1530","T1537","T1562.008","T1098","T1059.009","T1552.005"]
prerequisites	["T1078.004","T1552.005"]
version	1.0

AWS Post-Exploitation Methodology

AWS post-exploitation uses boto3, the AWS CLI, and direct metadata endpoint access to perform privilege escalation, data exfiltration, and persistence after compromising IAM credentials or gaining EC2 instance access. These tools target IAM misconfigurations, S3 data stores, Secrets Manager, Lambda functions, and SSM for lateral movement.

Prerequisites

Before deploying awshook tools, verify:

1. Valid AWS credentials — access key + secret key, session token, or instance profile
2. boto3 installed — pip3 install boto3
3. Current identity — aws sts get-caller-identity to confirm access
4. Region — set via --region, AWS_DEFAULT_REGION, or profile config

# Quick prerequisite check
aws sts get-caller-identity                    # verify credentials work
aws iam get-user 2>/dev/null || echo "No IAM user (likely role/instance profile)"
python3 -c "import boto3; print('boto3 OK')"   # verify boto3

Kill Chain Phases

Phase 1 — Situational Awareness (First 60 seconds)

Understand the AWS environment and current permissions.

Action	Command	Purpose
IAM enumeration	awshook iam_enum	Map all users, roles, policies; identify privilege escalation paths
Metadata harvest	awshook metadata_harvest	Extract IAM role credentials from EC2/ECS/Lambda metadata
CloudTrail status	awshook cloudtrail_blind --action status	Check logging configuration before any noisy operations

Phase 2 — Privilege Escalation

Exploit IAM misconfigurations to gain higher privileges.

Action	Command	Purpose
PassRole escalation	awshook iam_privesc --method passrole	Create Lambda with admin role via iam:PassRole