Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
With these permissions you can abuse a codestar IAM Role to perform arbitrary actions through a cloudformation template.
To exploit this you need to create a S3 bucket that is accessible from the attacked account. Upload a file called toolchain.json . This file should contain the cloudformation template exploit. The following one can be used to set a managed policy to a user under your control and give it admin permissions:
Also upload this empty zip file to the bucket:
Remember that the bucket with both files must be accessible by the victim account.
With both things uploaded you can now proceed to the exploitation creating a codestar project:
This exploit is based on the Pacu exploit of these privileges: https://github.com/RhinoSecurityLabs/pacu/blob/2a0ce01f075541f7ccd9c44fcfc967cad994f9c9/pacu/modules/iam__privesc_scan/main.py#L1997 On it you can find a variation to create an admin managed policy for a role instead of to a user.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
