Pacu

Pacu

Purpose

Use this skill for AWS-focused adversary simulation only when the rules of engagement explicitly allow deeper control-plane validation beyond basic read-only inspection.

Phase Fit

• Primary: Vulnerability Analysis, Validation and Controlled Impact Demonstration
• Secondary: Retest and Closure

Use When

• Need to assess realistic AWS privilege paths or service-specific risk.
• Need a module-driven workflow for an approved AWS objective.
• Need a repeatable retest for an AWS exposure path.

Avoid When

• AWS scope or module impact is unclear.
• The engagement only permits passive or read-only validation.

Inputs

• Approved AWS account and profile
• Explicitly allowed Pacu modules or objectives
• Stop conditions and evidence boundaries

Procedure

1. Confirm the exact AWS scope and allowed objectives.
2. Use only the minimum module set needed for the question.
3. Prefer read-oriented validation where possible.
4. Stop once the approved proof standard is met.
5. Preserve the exact module path and profile context for retest.

Command Syntax

Launch syntax is stable, while module execution happens inside the framework.

# Launch Pacu
pacu

# Inside the Pacu console:
import_keys --profile pentest      # Import AWS credentials
run iam__enum_users_roles_policies  # Enumerate IAM
run ec2__enum                       # Enumerate EC2 instances
run s3__bucket_finder               # Find S3 buckets
run iam__privesc_scan               # Scan for privilege escalation paths
run secretsmanager__enum            # Enumerate Secrets Manager
data                                # View all collected data

Evidence to Capture

• What the approved AWS principal could access or do
• Exact modules and account scope used
• Minimal proof path needed for remediation

Safety Boundaries

• Use only approved modules and approved AWS scope.
• Do not escalate to destructive or persistence-oriented actions without explicit written approval.