| name | aws-postexploit |
| description | AWS post-exploitation for IAM privilege escalation, data exfiltration, persistence, and operational security via boto3 |
| category | post-exploitation |
| tags | ["aws","cloud","post-exploitation","iam","s3","lambda","ssm","cloudtrail","credential-access","defense-evasion","persistence"] |
| tech_stack | ["aws","boto3","python"] |
| cwe_ids | ["CWE-269","CWE-522","CWE-693","CWE-284"] |
| chains_with | ["T1078.004","T1530","T1537","T1562.008","T1098","T1059.009","T1552.005"] |
| prerequisites | ["T1078.004","T1552.005"] |
| version | 1.0 |
AWS Post-Exploitation Methodology
AWS post-exploitation uses boto3, the AWS CLI, and direct metadata endpoint access to perform privilege escalation, data exfiltration, and persistence after compromising IAM credentials or gaining EC2 instance access. These tools target IAM misconfigurations, S3 data stores, Secrets Manager, Lambda functions, and SSM for lateral movement.
Prerequisites
Before deploying awshook tools, verify:
- Valid AWS credentials — access key + secret key, session token, or instance profile
- boto3 installed —
pip3 install boto3
- Current identity —
aws sts get-caller-identity to confirm access
- Region — set via
--region, AWS_DEFAULT_REGION, or profile config
aws sts get-caller-identity
aws iam get-user 2>/dev/null || echo "No IAM user (likely role/instance profile)"
python3 -c "import boto3; print('boto3 OK')"
Kill Chain Phases
Phase 1 — Situational Awareness (First 60 seconds)
Understand the AWS environment and current permissions.
| Action | Command | Purpose |
|---|
| IAM enumeration | awshook iam_enum | Map all users, roles, policies; identify privilege escalation paths |
| Metadata harvest | awshook metadata_harvest | Extract IAM role credentials from EC2/ECS/Lambda metadata |
| CloudTrail status | awshook cloudtrail_blind --action status | Check logging configuration before any noisy operations |
Phase 2 — Privilege Escalation
Exploit IAM misconfigurations to gain higher privileges.
| Action | Command | Purpose |
|---|
| PassRole escalation | awshook iam_privesc --method passrole | Create Lambda with admin role via iam:PassRole |
