AWS - IAM Privesc
Last updated
Last updated
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
For more info about IAM check:
AWS - IAM, Identity Center & SSO Enumiam:CreatePolicyVersionGrants the ability to create a new IAM policy version, bypassing the need for iam:SetDefaultPolicyVersion permission by using the --set-as-default flag. This enables defining custom permissions.
Exploit Command:
Impact: Directly escalates privileges by allowing any action on any resource.
iam:SetDefaultPolicyVersionAllows changing the default version of an IAM policy to another existing version, potentially escalating privileges if the new version has more permissions.
Bash Command:
Impact: Indirect privilege escalation by enabling more permissions.
iam:CreateAccessKeyEnables creating access key ID and secret access key for another user, leading to potential privilege escalation.
Exploit:
Impact: Direct privilege escalation by assuming another user's extended permissions.
iam:CreateLoginProfile | iam:UpdateLoginProfilePermits creating or updating a login profile, including setting passwords for AWS console login, leading to direct privilege escalation.
Exploit for Creation:
Exploit for Update:
Impact: Direct privilege escalation by logging in as "any" user.
iam:UpdateAccessKeyAllows enabling a disabled access key, potentially leading to unauthorized access if the attacker possesses the disabled key.
Exploit:
Impact: Direct privilege escalation by reactivating access keys.
iam:CreateServiceSpecificCredential | iam:ResetServiceSpecificCredentialEnables generating or resetting credentials for specific AWS services (e.g., CodeCommit, Amazon Keyspaces), inheriting the permissions of the associated user.
Exploit for Creation:
Exploit for Reset:
Impact: Direct privilege escalation within the user's service permissions.
iam:AttachUserPolicy || iam:AttachGroupPolicyAllows attaching policies to users or groups, directly escalating privileges by inheriting the permissions of the attached policy.
Exploit for User:
Exploit for Group:
Impact: Direct privilege escalation to anything the policy grants.
iam:AttachRolePolicy, ( sts:AssumeRole|iam:createrole) | iam:PutUserPolicy | iam:PutGroupPolicy | iam:PutRolePolicyPermits attaching or putting policies to roles, users, or groups, enabling direct privilege escalation by granting additional permissions.
Exploit for Role:
Exploit for Inline Policies:
You can use a policy like:
Impact: Direct privilege escalation by adding permissions through policies.
iam:AddUserToGroupEnables adding oneself to an IAM group, escalating privileges by inheriting the group's permissions.
Exploit:
Impact: Direct privilege escalation to the level of the group's permissions.
iam:UpdateAssumeRolePolicyAllows altering the assume role policy document of a role, enabling the assumption of the role and its associated permissions.
Exploit:
Where the policy looks like the following, which gives the user permission to assume the role:
Impact: Direct privilege escalation by assuming any role's permissions.
iam:UploadSSHPublicKey || iam:DeactivateMFADevicePermits uploading an SSH public key for authenticating to CodeCommit and deactivating MFA devices, leading to potential indirect privilege escalation.
Exploit for SSH Key Upload:
Exploit for MFA Deactivation:
Impact: Indirect privilege escalation by enabling CodeCommit access or disabling MFA protection.
iam:ResyncMFADeviceAllows resynchronization of an MFA device, potentially leading to indirect privilege escalation by manipulating MFA protection.
Bash Command:
Impact: Indirect privilege escalation by adding or manipulating MFA devices.
iam:UpdateSAMLProvider, iam:ListSAMLProviders, (iam:GetSAMLProvider)With these permissions you can change the XML metadata of the SAML connection. Then, you could abuse the SAML federation to login with any role that is trusting it.
Note that doing this legit users won't be able to login. However, you could get the XML, so you can put yours, login and configure the previous back
TODO: A Tool capable of generating the SAML metadata and login with a specified role
iam:UpdateOpenIDConnectProviderThumbprint, iam:ListOpenIDConnectProviders, (iam:GetOpenIDConnectProvider)(Unsure about this) If an attacker has these permissions he could add a new Thumbprint to manage to login in all the roles trusting the provider.
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
