codestar:CreateProject, codestar:AssociateTeamMember

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Check the subscription plans!
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

This is the created policy the user can privesc to (the project name was supercodestar):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "1",
            "Effect": "Allow",
            "Action": [
                "codestar:*",
                "iam:GetPolicy*",
                "iam:ListPolicyVersions"
            ],
            "Resource": [
                "arn:aws:codestar:eu-west-1:947247140022:project/supercodestar",
                "arn:aws:events:eu-west-1:947247140022:rule/awscodestar-supercodestar-SourceEvent",
                "arn:aws:iam::947247140022:policy/CodeStar_supercodestar_Owner"
            ]
        },
        {
            "Sid": "2",
            "Effect": "Allow",
            "Action": [
                "codestar:DescribeUserProfile",
                "codestar:ListProjects",
                "codestar:ListUserProfiles",
                "codestar:VerifyServiceRole",
                "cloud9:DescribeEnvironment*",
                "cloud9:ValidateEnvironmentName",
                "cloudwatch:DescribeAlarms",
                "cloudwatch:GetMetricStatistics",
                "cloudwatch:ListMetrics",
                "codedeploy:BatchGet*",
                "codedeploy:List*",
                "codestar-connections:UseConnection",
                "ec2:DescribeInstanceTypeOfferings",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeNatGateways",
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpcs",
                "events:ListRuleNamesByTarget",
                "iam:GetAccountSummary",
                "iam:GetUser",
                "iam:ListAccountAliases",
                "iam:ListRoles",
                "iam:ListUsers",
                "lambda:List*",
                "sns:List*"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "3",
            "Effect": "Allow",
            "Action": [
                "codestar:*UserProfile",
                "iam:GenerateCredentialReport",
                "iam:GenerateServiceLastAccessedDetails",
                "iam:CreateAccessKey",
                "iam:UpdateAccessKey",
                "iam:DeleteAccessKey",
                "iam:UpdateSSHPublicKey",
                "iam:UploadSSHPublicKey",
                "iam:DeleteSSHPublicKey",
                "iam:CreateServiceSpecificCredential",
                "iam:UpdateServiceSpecificCredential",
                "iam:DeleteServiceSpecificCredential",
                "iam:ResetServiceSpecificCredential",
                "iam:Get*",
                "iam:List*"
            ],
            "Resource": [
                "arn:aws:iam::947247140022:user/${aws:username}"
            ]
        }
    ]
}

Support HackTricks

Check the subscription plans!
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

PreviousAWS - Codestar Privesc Nextiam:PassRole, codestar:CreateProject

Last updated 3 months ago

{ "Version": "2012-10-17", "Statement": [ { "Sid": "1", "Effect": "Allow", "Action": [ "codestar:*", "iam:GetPolicy*", "iam:ListPolicyVersions" ], "Resource": [ "arn:aws:codestar:eu-west-1:947247140022:project/supercodestar", "arn:aws:events:eu-west-1:947247140022:rule/awscodestar-supercodestar-SourceEvent", "arn:aws:iam::947247140022:policy/CodeStar_supercodestar_Owner" ] }, { "Sid": "2", "Effect": "Allow", "Action": [ "codestar:DescribeUserProfile", "codestar:ListProjects", "codestar:ListUserProfiles", "codestar:VerifyServiceRole", "cloud9:DescribeEnvironment*", "cloud9:ValidateEnvironmentName", "cloudwatch:DescribeAlarms", "cloudwatch:GetMetricStatistics", "cloudwatch:ListMetrics", "codedeploy:BatchGet*", "codedeploy:List*", "codestar-connections:UseConnection", "ec2:DescribeInstanceTypeOfferings", "ec2:DescribeInternetGateways", "ec2:DescribeNatGateways", "ec2:DescribeRouteTables", "ec2:DescribeSecurityGroups", "ec2:DescribeSubnets", "ec2:DescribeVpcs", "events:ListRuleNamesByTarget", "iam:GetAccountSummary", "iam:GetUser", "iam:ListAccountAliases", "iam:ListRoles", "iam:ListUsers", "lambda:List*", "sns:List*" ], "Resource": [ "*" ] }, { "Sid": "3", "Effect": "Allow", "Action": [ "codestar:*UserProfile", "iam:GenerateCredentialReport", "iam:GenerateServiceLastAccessedDetails", "iam:CreateAccessKey", "iam:UpdateAccessKey", "iam:DeleteAccessKey", "iam:UpdateSSHPublicKey", "iam:UploadSSHPublicKey", "iam:DeleteSSHPublicKey", "iam:CreateServiceSpecificCredential", "iam:UpdateServiceSpecificCredential", "iam:DeleteServiceSpecificCredential", "iam:ResetServiceSpecificCredential", "iam:Get*", "iam:List*" ], "Resource": [ "arn:aws:iam::947247140022:user/${aws:username}" ] } ] }