translate everything

src/pentesting-cloud/aws-security/README.md

@@ -387,3 +387,7 @@ aws ...
 - [https://cloudsecdocs.com/aws/defensive/tooling/audit/](https://cloudsecdocs.com/aws/defensive/tooling/audit/)
 
 {{#include ../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-basic-information/README.md

@@ -384,3 +384,7 @@ If you are looking for something **similar** to this but for the **browser** you
 - [https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html](https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html)
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-basic-information/aws-federation-abuse.md

@@ -127,3 +127,7 @@ In order to specify **which service account should be able to assume the role,**
 - [https://www.eliasbrange.dev/posts/secure-aws-deploys-from-github-actions-with-oidc/](https://www.eliasbrange.dev/posts/secure-aws-deploys-from-github-actions-with-oidc/)
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-permissions-for-a-pentest.md

@@ -15,3 +15,7 @@ These are the permissions you need on each AWS account you want to audit to be a
     - Optional if the client removes the analyzers for you, but usually it's easier just to ask for this permission)
 
 {{#include ../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/README.md

@@ -1,2 +1,6 @@
 # AWS - Persistence
 
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-api-gateway-persistence.md

@@ -30,3 +30,7 @@ If API keys are used, you could leak them to maintain persistence or even create
 Or just remove the use of API keys.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-cognito-persistence.md

@@ -40,3 +40,7 @@ By default this is disabled:
 <figure><img src="https://lh6.googleusercontent.com/EOiM0EVuEgZDfW3rOJHLQjd09-KmvraCMssjZYpY9sVha6NcxwUjStrLbZxAT3D3j9y08kd5oobvW8a2fLUVROyhkHaB1OPhd7X6gJW3AEQtlZM62q41uYJjTY1EJ0iQg6Orr1O7yZ798EpIJ87og4Tbzw=s2048" alt=""><figcaption></figcaption></figure>
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-dynamodb-persistence.md

@@ -61,3 +61,7 @@ aws dynamodb put-item \
 The compromised instances or Lambda functions can periodically check the C2 table for new commands, execute them, and optionally report the results back to the table. This allows the attacker to maintain persistence and control over the compromised resources.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-ec2-persistence.md

@@ -52,3 +52,7 @@ Create a VPN so the attacker will be able to connect directly through i to the V
 Create a peering connection between the victim VPC and the attacker VPC so he will be able to access the victim VPC.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-ecr-persistence.md

@@ -95,3 +95,7 @@ aws ecr put-replication-configuration \
 ```
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-ecs-persistence.md

@@ -97,3 +97,7 @@ aws ecs create-service --service-name "undocumented-service" --task-definition "
 ```
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-efs-persistence.md

@@ -19,3 +19,7 @@ Modifying the **resource policy and/or security groups** you can try to persist
 You could **create an access point** (with root access to `/`) accessible from a service were you have implemented **other persistence** to keep privileged access to the file system.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-elastic-beanstalk-persistence.md

@@ -75,3 +75,7 @@ aws elasticbeanstalk update-environment --environment-name my-env --option-setti
 ```
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-iam-persistence.md

@@ -47,3 +47,7 @@ Give Administrator permissions to a policy in not its last version (the last ver
 If the account is already trusting a common identity provider (such as Github) the conditions of the trust could be increased so the attacker can abuse them.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-kms-persistence.md

@@ -37,3 +37,7 @@ aws kms list-grants --key-id <key-id>
 > A grant can give permissions only from this: [https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations](https://docs.aws.amazon.com/kms/latest/developerguide/grants.html#terms-grant-operations)
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/README.md

@@ -62,3 +62,7 @@ Here you have some ideas to make your **presence in AWS more stealth by creating
 - Every time new cloudtrail logs are generated, delete/alter them
 
 {{#include ../../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-abusing-lambda-extensions.md

@@ -40,3 +40,7 @@ The tool [**lambda-spy**](https://github.com/clearvector/lambda-spy) was created
 - [https://www.clearvector.com/blog/lambda-spy/](https://www.clearvector.com/blog/lambda-spy/)
 
 {{#include ../../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-lambda-persistence/aws-lambda-layers-persistence.md

@@ -128,3 +128,7 @@ aws lambda remove-layer-version-permission --layer-name ExternalBackdoor --state
 ```
 
 {{#include ../../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-lightsail-persistence.md

@@ -31,3 +31,7 @@ If domains are configured:
 - Configure the **main domain IP to your own one** and perform a **MitM** from your IP to the legit ones
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-rds-persistence.md

@@ -29,3 +29,7 @@ aws rds modify-db-snapshot-attribute --db-snapshot-identifier <snapshot-name> --
 ```
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-s3-persistence.md

@@ -23,3 +23,7 @@ Therefore, and attacker could get this key from the metadata and decrypt with KM
 Although usually ACLs of buckets are disabled, an attacker with enough privileges could abuse them (if enabled or if the attacker can enable them) to keep access to the S3 bucket.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-secrets-manager-persistence.md

@@ -51,3 +51,7 @@ def generate_password():
 ```
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-sns-persistence.md

@@ -79,3 +79,7 @@ aws sns subscribe --region <region> \
 ```
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-sqs-persistence.md

@@ -37,3 +37,7 @@ The following policy gives everyone in AWS access to everything in the queue cal
 > You could even **trigger a Lambda in the attackers account every-time a new message** is put in the queue (you would need to re-put it) somehow. For this follow these instructinos: [https://docs.aws.amazon.com/lambda/latest/dg/with-sqs-cross-account-example.html](https://docs.aws.amazon.com/lambda/latest/dg/with-sqs-cross-account-example.html)
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-ssm-perssitence.md

@@ -1,2 +1,6 @@
 # AWS - SSM Perssitence
 
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-step-functions-persistence.md

@@ -19,3 +19,7 @@ Backdoor a step function to make it perform any persistence trick so every time
 If the AWS account is using aliases to call step functions it would be possible to modify an alias to use a new backdoored version of the step function.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-persistence/aws-sts-persistence.md

@@ -129,3 +129,7 @@ Write-Host "Role juggling check complete."
 </details>
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/README.md

@@ -1,2 +1,6 @@
 # AWS - Post Exploitation
 
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-api-gateway-post-exploitation.md

@@ -144,3 +144,7 @@ aws apigateway create-usage-plan-key --usage-plan-id $USAGE_PLAN --key-id $API_K
 > Need testing
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-cloudfront-post-exploitation.md

@@ -29,3 +29,7 @@ Accessing the response you could steal the users cookie and inject a malicious J
 You can check the [**tf code to recreate this scenarios here**](https://github.com/adanalvarez/AWS-Attack-Scenarios/tree/main).
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/README.md

@@ -82,3 +82,7 @@ aws codebuild delete-source-credentials --arn <value>
 **Potential Impact**: Disruption of normal functioning for applications relying on the affected repository due to the removal of source credentials.
 
 {{#include ../../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-token-leakage.md

@@ -186,3 +186,7 @@ aws codebuild start-build --project-name <proj-name>
 > Now an attacker will be able to use the token from his machine, list all the privileges it has and (ab)use easier than using the CodeBuild service directly.
 
 {{#include ../../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-control-tower-post-exploitation.md

@@ -18,3 +18,7 @@ aws controltower enable-control --control-identifier <arn_control_id> --target-i
 ```
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dlm-post-exploitation.md

@@ -93,3 +93,7 @@ A template for the policy document can be seen here:
 ```
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-dynamodb-post-exploitation.md

@@ -347,3 +347,7 @@ bashCopy codeaws dynamodbstreams get-records \
 **Potential impact**: Real-time monitoring and data leakage of the DynamoDB table's changes.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md

@@ -475,3 +475,7 @@ if __name__ == "__main__":
 ```
 
 {{#include ../../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-snapshot-dump.md

@@ -139,3 +139,7 @@ You can use this tool to automate the attack: [https://github.com/Static-Flow/Cl
 - [https://devopscube.com/mount-ebs-volume-ec2-instance/](https://devopscube.com/mount-ebs-volume-ec2-instance/)
 
 {{#include ../../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-malicious-vpc-mirror.md

@@ -13,3 +13,7 @@ The **impact** of malicious VPC traffic mirroring can be significant, as it allo
 For more information and access to the [**malmirror script**](https://github.com/RhinoSecurityLabs/Cloud-Security-Research/tree/master/AWS/malmirror), it can be found on our **GitHub repository**. The script automates and streamlines the process, making it **quick, simple, and repeatable** for offensive research purposes.
 
 {{#include ../../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecr-post-exploitation.md

@@ -94,3 +94,7 @@ aws ecr-public batch-delete-image --repository-name your-ecr-repo-name --image-i
 ```
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ecs-post-exploitation.md

@@ -61,3 +61,7 @@ aws ecs submit-attachment-state-changes ...
 The EC2 instance will probably also have the permission `ecr:GetAuthorizationToken` allowing it to **download images** (you could search for sensitive info in them).
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-efs-post-exploitation.md

@@ -52,3 +52,7 @@ aws efs delete-access-point --access-point-id <value>
 **Potential Impact**: Unauthorized access to the file system, data exposure or modification.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-eks-post-exploitation.md

@@ -153,3 +153,7 @@ So, if an **attacker compromises a cluster using fargate** and **removes all the
 > Actually, If the cluster is using Fargate you could EC2 nodes or move everything to EC2 to the cluster and recover it accessing the tokens in the node.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-elastic-beanstalk-post-exploitation.md

@@ -78,3 +78,7 @@ aws elasticbeanstalk remove-tags --resource-arn arn:aws:elasticbeanstalk:us-west
 **Potential Impact**: Incorrect resource allocation, billing, or resource management due to added or removed tags.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation.md

@@ -101,3 +101,7 @@ A common way to avoid Confused Deputy problems is the use of a condition with `A
 - [https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html)
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation.md

@@ -131,3 +131,7 @@ aws kms schedule-key-deletion \
 <figure><img src="../../../images/image (76).png" alt=""><figcaption></figcaption></figure>
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/README.md

@@ -27,3 +27,7 @@ Abusing Lambda Layers it's also possible to abuse extensions and persist in the
 {{#endref}}
 
 {{#include ../../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lambda-post-exploitation/aws-warm-lambda-persistence.md

@@ -61,3 +61,7 @@ For more info check [https://github.com/carlospolop/lambda_bootstrap_switcher](h
 - [https://unit42.paloaltonetworks.com/gaining-persistency-vulnerable-lambdas/](https://unit42.paloaltonetworks.com/gaining-persistency-vulnerable-lambdas/)
 
 {{#include ../../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-lightsail-post-exploitation.md

@@ -28,3 +28,7 @@ Check out the Lightsail privesc options to learn different ways to access potent
 {{#endref}}
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-organizations-post-exploitation.md

@@ -17,3 +17,7 @@ aws organizations deregister-account --account-id <account_id> --region <region>
 ```
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-rds-post-exploitation.md

@@ -90,3 +90,7 @@ aws rds start-export-task --export-task-identifier attacker-export-task --source
 **Potential impact**: Access to sensitive data in the exported snapshot.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-s3-post-exploitation.md

@@ -36,3 +36,7 @@ Finally, the attacker could upload a final file, usually named "ransom-note.txt,
 **For more info** [**check the original research**](https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/)**.**
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-secrets-manager-post-exploitation.md

@@ -47,3 +47,7 @@ aws secretsmanager delete-secret \
 ```
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-ses-post-exploitation.md

@@ -81,3 +81,7 @@ aws sesv2 send-custom-verification-email --email-address <value> --template-name
 Still to test.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sns-post-exploitation.md

@@ -78,3 +78,7 @@ aws sns untag-resource --resource-arn <value> --tag-keys <key>
 **Potential Impact**: Disruption of cost allocation, resource tracking, and tag-based access control policies.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sqs-post-exploitation.md

@@ -85,3 +85,7 @@ arduinoCopy codeaws sqs remove-permission --queue-url <value> --label <value>
 **Potential Impact**: Disruption of normal functioning for applications relying on the queue due to unauthorized removal of permissions.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sso-and-identitystore-post-exploitation.md

@@ -23,3 +23,7 @@ aws sso-admin delete-account-assignment --instance-arn <SSOInstanceARN> --target
 ```
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-stepfunctions-post-exploitation.md

@@ -72,3 +72,7 @@ aws stepfunctions untag-resource --resource-arn <value> --tag-keys <key>
 **Potential Impact**: Disruption of cost allocation, resource tracking, and tag-based access control policies.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sts-post-exploitation.md

@@ -102,3 +102,7 @@ response = client.get_secret_value(SecretId="flag_secret") print(response['Secre
 ```
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-post-exploitation/aws-vpn-post-exploitation.md

@@ -11,3 +11,7 @@ For more information:
 {{#endref}}
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/README.md

@@ -21,3 +21,7 @@ The way to escalate your privileges in AWS is to have enough permissions to be a
 - [Pacu](https://github.com/RhinoSecurityLabs/pacu)
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apigateway-privesc.md

@@ -105,3 +105,7 @@ aws apigateway update-vpc-link --vpc-link-id $VPC_LINK_ID --patch-operations op=
 **Potential Impact**: Unauthorized access to private API resources, interception or disruption of API traffic.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-chime-privesc.md

@@ -7,3 +7,7 @@
 TODO
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/README.md

@@ -116,3 +116,7 @@ An attacker could abuse this permission without the passRole permission to updat
 - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)
 
 {{#include ../../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cloudformation-privesc/iam-passrole-cloudformation-createstack-and-cloudformation-describestacks.md

@@ -79,3 +79,7 @@ aws cloudformation describe-stacks \
 - [https://bishopfox.com/blog/privilege-escalation-in-aws](https://bishopfox.com/blog/privilege-escalation-in-aws)
 
 {{#include ../../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc.md

@@ -347,3 +347,7 @@ More details could be found [here](https://www.shielder.com/blog/2023/07/aws-cod
 **Potential Impact:** Direct privesc to attached AWS Codebuild roles.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codepipeline-privesc.md

@@ -35,3 +35,7 @@ It might be possible to modify the role used and the command executed on a codep
 > When this API is called, CodePipeline **returns temporary credentials for the S3 bucket** used to store artifacts for the pipeline, if the action requires access to that S3 bucket for input or output artifacts. This API also **returns any secret values defined for the action**.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/README.md

@@ -71,3 +71,7 @@ You can find the exploit in [https://github.com/RhinoSecurityLabs/Cloud-Security
 **Potential Impact:** Privesc to cloudformation IAM role.
 
 {{#include ../../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/codestar-createproject-codestar-associateteammember.md

@@ -79,3 +79,7 @@ This is the created policy the user can privesc to (the project name was `superc
 ```
 
 {{#include ../../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-codestar-privesc/iam-passrole-codestar-createproject.md

@@ -86,3 +86,7 @@ aws codestar create-project \
 This exploit is based on the **Pacu exploit of these privileges**: [https://github.com/RhinoSecurityLabs/pacu/blob/2a0ce01f075541f7ccd9c44fcfc967cad994f9c9/pacu/modules/iam\_\_privesc_scan/main.py#L1997](https://github.com/RhinoSecurityLabs/pacu/blob/2a0ce01f075541f7ccd9c44fcfc967cad994f9c9/pacu/modules/iam__privesc_scan/main.py#L1997) On it you can find a variation to create an admin managed policy for a role instead of to a user.
 
 {{#include ../../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-cognito-privesc.md

@@ -312,3 +312,7 @@ $ cognito-scanner --help
 For more information check [https://github.com/padok-team/cognito-scanner](https://github.com/padok-team/cognito-scanner)
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-datapipeline-privesc.md

@@ -72,3 +72,7 @@ The **pipeline definition file, crafted by the attacker, includes directives to
 - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-directory-services-privesc.md

@@ -32,3 +32,7 @@ And then **grant them an AWS IAM role** for when they login, this way an AD user
 There isn't apparently any way to enable the application access URL, the AWS Management Console and grant permission
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-dynamodb-privesc.md

@@ -21,3 +21,7 @@ As far as I know there is **no direct way to escalate privileges in AWS just by
 ### TODO: Read data abusing data Streams
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ebs-privesc.md

@@ -25,3 +25,7 @@ Any AWS user possessing the **`EC2:CreateSnapshot`** permission can steal the ha
 You can use this tool to automate the attack: [https://github.com/Static-Flow/CloudCopy](https://github.com/Static-Flow/CloudCopy) or you could use one of the previous techniques after creating a snapshot.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc.md

@@ -289,3 +289,7 @@ Assuming we find `aws_access_key_id` and `aws_secret_access_key`, we can use the
 - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecr-privesc.md

@@ -106,3 +106,7 @@ aws ecr set-repository-policy \
 ```
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecs-privesc.md

@@ -248,3 +248,7 @@ aws ecs update-service-primary-task-set --cluster existing-cluster --service exi
 - [https://ruse.tech/blogs/ecs-attack-methods](https://ruse.tech/blogs/ecs-attack-methods)
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-efs-privesc.md

@@ -94,3 +94,7 @@ aws efs modify-mount-target-security-groups \
 **Potential Impact:** Indirect privesc by locating sensitive information in the file system.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-elastic-beanstalk-privesc.md

@@ -183,3 +183,7 @@ The developer has intentions to establish a reverse shell using Netcat or Socat
 ```
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-emr-privesc.md

@@ -62,3 +62,7 @@ The URL of the notebook is `https://<notebook-id>.emrnotebooks-prod.eu-west-1.am
 **Potential Impact:** Privesc to AWS managed role arn:aws:iam::420254708011:instance-profile/prod-EditorInstanceProfile
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-gamelift.md

@@ -16,3 +16,7 @@ aws gamelift request-upload-credentials \
 - [https://gist.github.com/kmcquade/33860a617e651104d243c324ddf7992a](https://gist.github.com/kmcquade/33860a617e651104d243c324ddf7992a)
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-glue-privesc.md

@@ -90,3 +90,7 @@ Just with the update permission an attacked could steal the IAM Credentials of t
 - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc.md

@@ -271,3 +271,7 @@ aws iam update-open-id-connect-provider-thumbprint --open-id-connect-provider-ar
 - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/)
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-kms-privesc.md

@@ -120,3 +120,7 @@ For more information check:
 {{#endref}}
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc.md

@@ -290,3 +290,7 @@ Some lambdas are going to be **receiving sensitive info from the users in parame
 - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/)
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lightsail-privesc.md

@@ -160,3 +160,7 @@ aws lightsail update-domain-entry \
 **Potential Impact:** Takeover a domain
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mediapackage-privesc.md

@@ -23,3 +23,7 @@ aws mediapackage rotate-ingest-endpoint-credentials --id test --ingest-endpoint-
 - [https://gist.github.com/kmcquade/33860a617e651104d243c324ddf7992a](https://gist.github.com/kmcquade/33860a617e651104d243c324ddf7992a)
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-mq-privesc.md

@@ -47,3 +47,7 @@ If you could somehow find the original credentials used by ActiveMQ you could pe
 **Potential Impact:** Steal ActiveMQ credentials
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-msk-privesc.md

@@ -22,3 +22,7 @@ You need access to the VPC because **you cannot enable None authentication with
 If **IAM role-based authentication** is used and **kafka is publicly exposed** you could still abuse these privileges to give you permissions to access it.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-organizations-prinvesc.md

@@ -16,3 +16,7 @@ If you compromise the root/management account, chances are you can compromise al
 To [**learn how check this page**](../#compromising-the-organization).
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc.md

@@ -167,3 +167,7 @@ aws rds add-role-to-db-instance --db-instance-identifier target-instance --role-
 **Potential Impact**: Access to sensitive data or unauthorized modifications to the data in the RDS instance.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-redshift-privesc.md

@@ -105,3 +105,7 @@ Check [https://docs.aws.amazon.com/redshift/latest/dg/loading-data-from-emr.html
 - [https://gist.github.com/kmcquade/33860a617e651104d243c324ddf7992a](https://gist.github.com/kmcquade/33860a617e651104d243c324ddf7992a)
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-s3-privesc.md

@@ -181,3 +181,7 @@ aws s3api put-object-acl --bucket <bucket-name> --key flag --version-id <value>
 ```
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sagemaker-privesc.md

@@ -112,3 +112,7 @@ An attacker with those permissions will (potentially) be able to create an **hyp
 - [https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/](https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation-part-2/)
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-secrets-manager-privesc.md

@@ -49,3 +49,7 @@ policy.json:
 ```
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sns-privesc.md

@@ -41,3 +41,7 @@ aws sns add-permission --topic-arn <value> --label <value> --aws-account-id <val
 **Potential Impact**: Unauthorized access to the topic, message exposure, or topic manipulation by unauthorized users or services, disruption of normal functioning for applications relying on the topic.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sqs-privesc.md

@@ -44,3 +44,7 @@ aws sqs change-message-visibility --queue-url <value> --receipt-handle <value> -
 **Potential Impact**: Steal sensitive information, Message loss, data corruption, and service disruption for applications relying on the affected messages.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ssm-privesc.md

@@ -130,3 +130,7 @@ aws-codebuild-privesc.md
 {{#endref}}
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-sso-and-identitystore-privesc.md

@@ -130,3 +130,7 @@ aws sso-admin   delete-permissions-boundary-from-permission-set --instance-arn <
 ```
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-stepfunctions-privesc.md

@@ -251,3 +251,7 @@ aws stepfunctions update-state-machine --state-machine-arn arn:aws:states:us-eas
 **Potential Impact**: Unauthorized execution and manipulation of workflows and access to sensitive resources, potentially leading to significant security breaches.
 
 {{#include ../../../banners/hacktricks-training.md}}
+
+
+
+