codestar:CreateProject, codestar:AssociateTeamMember

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

• If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!

• Get the official PEASS & HackTricks swag

• Discover The PEASS Family, our collection of exclusive NFTs

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

This is the created policy the user can privesc to (the project name was supercodestar):

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "1",
            "Effect": "Allow",
            "Action": [
                "codestar:*",
                "iam:GetPolicy*",
                "iam:ListPolicyVersions"
            ],
            "Resource": [
                "arn:aws:codestar:eu-west-1:947247140022:project/supercodestar",
                "arn:aws:events:eu-west-1:947247140022:rule/awscodestar-supercodestar-SourceEvent",
                "arn:aws:iam::947247140022:policy/CodeStar_supercodestar_Owner"
            ]
        },
        {
            "Sid": "2",
            "Effect": "Allow",
            "Action": [
                "codestar:DescribeUserProfile",
                "codestar:ListProjects",
                "codestar:ListUserProfiles",
                "codestar:VerifyServiceRole",
                "cloud9:DescribeEnvironment*",
                "cloud9:ValidateEnvironmentName",
                "cloudwatch:DescribeAlarms",
                "cloudwatch:GetMetricStatistics",
                "cloudwatch:ListMetrics",
                "codedeploy:BatchGet*",
                "codedeploy:List*",
                "codestar-connections:UseConnection",
                "ec2:DescribeInstanceTypeOfferings",
                "ec2:DescribeInternetGateways",
                "ec2:DescribeNatGateways",
                "ec2:DescribeRouteTables",
                "ec2:DescribeSecurityGroups",
                "ec2:DescribeSubnets",
                "ec2:DescribeVpcs",
                "events:ListRuleNamesByTarget",
                "iam:GetAccountSummary",
                "iam:GetUser",
                "iam:ListAccountAliases",
                "iam:ListRoles",
                "iam:ListUsers",
                "lambda:List*",
                "sns:List*"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Sid": "3",
            "Effect": "Allow",
            "Action": [
                "codestar:*UserProfile",
                "iam:GenerateCredentialReport",
                "iam:GenerateServiceLastAccessedDetails",
                "iam:CreateAccessKey",
                "iam:UpdateAccessKey",
                "iam:DeleteAccessKey",
                "iam:UpdateSSHPublicKey",
                "iam:UploadSSHPublicKey",
                "iam:DeleteSSHPublicKey",
                "iam:CreateServiceSpecificCredential",
                "iam:UpdateServiceSpecificCredential",
                "iam:DeleteServiceSpecificCredential",
                "iam:ResetServiceSpecificCredential",
                "iam:Get*",
                "iam:List*"
            ],
            "Resource": [
                "arn:aws:iam::947247140022:user/${aws:username}"
            ]
        }
    ]
}

Learn AWS hacking from zero to hero with htARTE (HackTricks AWS Red Team Expert)!

Other ways to support HackTricks:

• If you want to see your company advertised in HackTricks or download HackTricks in PDF Check the SUBSCRIPTION PLANS!

• Get the official PEASS & HackTricks swag

• Discover The PEASS Family, our collection of exclusive NFTs

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share your hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.