aibot88 pentest-cloud
AWS / Azure / GCP pentest methodology. IAM lateral path, public asset enum, container escape pattern.
Triggers
- "AWS pentest"
- "Azure AD test"
- "GCP IAM enum"
- "S3 public bucket"
- "EC2 metadata abuse"
- "IMDSv2 bypass"
- "Pacu / ScoutSuite / Prowler kullanim"
Cloud-Provider Spesifik
AWS
| Saldiri Yuzeyi | Test |
|---|---|
| S3 public read/write | aws s3 ls s3://<bucket> --no-sign-request |
| EC2 IMDSv1 | curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ |
| Lambda env leak | Lambda invoke + env var dump |
| IAM privilege esc | iam:CreateAccessKey, iam:AttachUserPolicy, sts:AssumeRole |
| CloudTrail bypass | sts:GetSessionToken (logged as user, not source) |
| Misconfigured IAM | * action on * resource |
| Cross-account roles | external Principal "arn:aws:iam::OTHER:root" |
| Resource policy | S3 bucket policy with "Principal": "*" |
| SSM RunCommand | EC2 to OS via SSM session manager |
Azure
| Saldiri Yuzeyi | Test |
|---|---|
| Anonymous storage container | https://<acc>.blob.core.windows.net/<container>?restype=container&comp=list |
| Azure AD enumeration | UserList API anonymous |
| Service Principal abuse | Excessive RBAC role assignment |
| Managed Identity | VM -> token endpoint -> assume role |
| Azure DevOps PAT | Repo scan for PAT in code |
| Key Vault | RBAC misconfig, public access |
GCP
| Saldiri Yuzeyi | Test |
|---|---|
| GCS public bucket | gsutil ls gs://<bucket> (no auth) |
| Compute metadata | curl http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token -H "Metadata-Flavor: Google" |
| IAM lateral | iam.serviceAccounts.actAs, iam.roles.update |
| GKE container | RBAC misconfig + IMDS reach |
Onerilen Komutlar
# QUIET — AWS misconfig audit (read-only IAM)
prowler aws --profile <profile> --severity high,critical
# QUIET — ScoutSuite multi-cloud audit
scout aws --profile <profile> --report-dir ./scout-report
# MODERATE — Pacu enumeration (Pacu CLI)
# Pacu db'ye bagli; --modules ile spesifik recon
# MODERATE — Azure recon
roadtools roadrecon auth --device-code
roadtools roadrecon gather
# MODERATE — GCP enum (Hayat icin tum projeyi sayar, dikkat)
gcloud projects list
gcloud iam service-accounts list --project=<project>
IAM Privilege Escalation Patterns
AWS PrivEsc (yaygin 25):
1. iam:CreateAccessKey on another user
2. iam:CreateLoginProfile on another user
3. iam:UpdateLoginProfile on another user
4. iam:AttachUserPolicy + ManagedPolicy AdministratorAccess
5. iam:AttachGroupPolicy
6. iam:AttachRolePolicy
7. iam:PutUserPolicy (inline policy)
8. iam:PutGroupPolicy
9. iam:PutRolePolicy
10. iam:AddUserToGroup
11. iam:UpdateAssumeRolePolicy
12. iam:PassRole + service action (lambda, ec2)
13. sts:AssumeRole (broad principal)
14. lambda:UpdateFunctionCode + lambda:InvokeFunction
15. lambda:CreateFunction + iam:PassRole
... (Pacu modulleri ile otomatize edilir)
Container Escape (K8s)
# QUIET — pod RBAC check (kubectl in pod)
kubectl auth can-i --list
# Pod escape signal:
# - hostPID: true
# - hostNetwork: true
# - privileged: true
# - hostPath mount /
# - Capabilities: SYS_ADMIN, SYS_PTRACE
# Service account token
cat /var/run/secrets/kubernetes.io/serviceaccount/token
# IMDSv1 reach from pod
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
Output Sablonu
## Cloud Pentest — <account>
### IAM Path
- User: dev-readonly
- Excessive: iam:UpdateAssumeRolePolicy on role "prod-admin"
- Path: dev-readonly -> update trust policy -> sts:AssumeRole prod-admin -> *
- Time-to-DA: 2 dakika
### Public Asset
- S3 bucket "company-backups" — anonymous list + read (1.2TB ifsa)
- 3 prod EC2 instance IMDSv1 only -> SSRF chain riski
### Defensive Onerisi
- IAM policy review: iam:* aksiyonlari sadece break-glass acct
- S3 bucket policy: Principal "*" yasak (block public access acct-level)
- EC2 metadata: IMDSv2 zorunlu (hop limit 1)
Out-of-Scope
- Production veri silme / yazma
- Resource olusturma (cost olusturmadan dikkat — engagement cost limiti)
- taraf service (Stripe, SendGrid) — out-of-scope default