1. Mental Model & Architectural Core
Pacu is the AWS exploitation framework, analogous to Metasploit for cloud environments. It provides 60+ modules for enumerating IAM permissions, discovering privilege escalation paths (21 distinct vectors), establishing persistence via Lambda backdoors, and exfiltrating data from S3 buckets.
AWS is a sprawling corporate campus where everyone has a badge (IAM credentials). Pacu is an insider threat investigator who systematically maps which doors every badge opens, identifies the janitor whose badge accidentally opens the server room, and shows you the 3-step path from intern access to CEO office.
- AWS penetration testing: enumerate all IAM permissions for a given access key
- Find IAM privilege escalation paths (iam:PassRole + lambda, iam:CreatePolicyVersion)
- Enumerate EC2 instances, S3 buckets, Lambda functions, and RDS instances
- Test for EC2 IMDSv2 misconfigurations and SSRF-accessible metadata
- Bug bounty: given leaked AWS access key, enumerate all accessible resources and escalation paths
- Red team: from SSRF-extracted EC2 metadata credentials, escalate to full admin via Lambda PassRole
- Audit: verify no IAM escalation paths exist in production AWS environment
Pacu uses boto3 (AWS Python SDK) to enumerate and exploit AWS services. Modules run within a persistent session that stores discovered resources. The privilege escalation module implements all 21 known IAM escalation paths by testing available API calls against current permissions.
2. Syntax, Flags & Live Telemetry
| Flag / Option | Description |
|---|---|
| run iam__enum_permissions | Enumerate all IAM permissions for current credentials |
| run iam__privesc_scan | Automatically scan for IAM privilege escalation paths |
| run s3__enum | Enumerate all accessible S3 buckets and their contents |
| run ec2__enum | Enumerate all EC2 instances, security groups, and key pairs |
| run lambda__enum | Enumerate Lambda functions, their code, and environment variables |
| set_keys | Configure AWS access key and secret key for Pacu session |
pacu --session aws_pentest Pacu > set_keys Pacu > run iam__enum_permissions Pacu > run iam__privesc_scan
TOKEN=$(curl -s -X PUT http://169.254.169.254/latest/api/token -H "X-aws-ec2-metadata-token-ttl-seconds: 21600") curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/
After extracting EC2 instance credentials, immediately check the attached IAM role's policies with aws iam list-attached-role-policies --role-name EC2-S3-Admin-Role. High-privilege roles are common in EC2 instances, often granting iam:*, s3:*, or lambda:* to entire accounts.
3. Hands-On Practice Labs & Cyber Ranges
4. Detection & Prevention Playbook
- Implement AWS SCP (Service Control Policies) to prevent iam:CreatePolicyVersion
- Use least-privilege IAM policies no wildcard permissions
- Enable AWS CloudTrail in all regions with log file validation
- Deploy GuardDuty for automated threat detection in AWS
- Require IMDSv2 on all EC2 instances (disable IMDSv1)