From b6bee3cc89eae7019edc679a6db5e31dbbc3165a Mon Sep 17 00:00:00 2001
From: Translator <github-actions@github.com>
Date: Tue, 24 Jun 2025 14:00:33 +0000
Subject: [PATCH] Translated
 ['src/pentesting-cloud/aws-security/aws-privilege-escalation/

---
 .../aws-iam-roles-anywhere-privesc.md         | 42 +++++++++++++++++++
 theme/ai.js                                   |  2 +-
 2 files changed, 43 insertions(+), 1 deletion(-)
 create mode 100644 src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-roles-anywhere-privesc.md

diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-roles-anywhere-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-roles-anywhere-privesc.md
new file mode 100644
index 000000000..1debe0c02
--- /dev/null
+++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-roles-anywhere-privesc.md
@@ -0,0 +1,42 @@
+# AWS - IAM Roles Anywhere Privesc
+
+{{#include ../../../../banners/hacktricks-training.md}}
+
+AWS IAM RolesAnywhere permite que cargas de trabajo fuera de AWS asuman roles de IAM utilizando certificados X.509. Pero cuando las políticas de confianza no están adecuadamente definidas, pueden ser abusadas para la escalada de privilegios.
+
+Esta política carece de restricciones sobre qué ancla de confianza o atributos de certificado están permitidos. Como resultado, cualquier certificado vinculado a cualquier ancla de confianza en la cuenta puede ser utilizado para asumir este rol.
+```json
+{
+"Version": "2012-10-17",
+"Statement": [
+{
+"Effect": "Allow",
+"Principal": {
+"Service": "rolesanywhere.amazonaws.com"
+},
+"Action": [
+"sts:AssumeRole",
+"sts:SetSourceIdentity",
+"sts:TagSession"
+]
+}
+]
+}
+
+```
+Para privesc, se requiere el `aws_signing_helper` de https://docs.aws.amazon.com/rolesanywhere/latest/userguide/credential-helper.html
+
+Luego, utilizando un certificado válido, el atacante puede pivotar hacia el rol de mayor privilegio.
+```bash
+aws_signing_helper credential-process \
+--certificate readonly.pem \
+--private-key readonly.key \
+--trust-anchor-arn arn:aws:rolesanywhere:us-east-1:123456789012:trust-anchor/ta-id \
+--profile-arn arn:aws:rolesanywhere:us-east-1:123456789012:profile/default \
+--role-arn arn:aws:iam::123456789012:role/Admin
+```
+### Referencias
+
+- https://www.ruse.tech/blogs/aws-roles-anywhere-privilege-escalation/
+
+{{#include ../../../../banners/hacktricks-training.md}}
diff --git a/theme/ai.js b/theme/ai.js
index c94992d5f..13337c3f1 100644
--- a/theme/ai.js
+++ b/theme/ai.js
@@ -226,7 +226,7 @@
         `threadId=${threadId}; Path=/; Secure; SameSite=Strict; Max-Age=7200`;
     } catch (e) {
       console.error("Error creating threadId:", e);
-      alert("Failed to initialise the conversation. Please refresh.");
+      console.log("Failed to initialise the conversation. Please refresh.");
       throw e;
     }
   }