Pacu

Rhino Security is a consultancy that specializes in cloud penetration testing and has done extensive work in looking at security issues in cloud environments like AWS. They have created an exploitation tool called Pacu that is designed to interoperate with the AWS API. The tool is written in Python and somewhat feels like Metasploit, but not exactly. It has over 35 modules for AWS environments and can manage multiple AWS profiles. The tool features components in reconnaissance, enumeration, mapping, privilege escalation, and even persistence modules. You can pull the tool from the following location: http://www.github.com/RhinoSecurityLabs/pacu. 39 h

For lateral movements you have two options to move around the system:

− cloudtrail__csv_injection: This injects a malicious payload into a CloudTrail event that becomes a Microsoft Excel document that executes on the host. This is done by trying to create an EC2 instance with the payload as the name. This event will be logged as not working with the instance's name in the columns.

− vpc__enum_lateral_movement: Lists all DirectConnect and VPN connections so that you can see what additional networks you can move into

Pacu features several exploits to allow you to gain host access, access to the services in the environment, or obtain the items in those resources

Services included are EC2, Lightsail, EBS, and API Gateway

− EC2: Typically, these exploits will allow you to gain a shell through either a startup script or through the systems manager agent in EC2

− Lightsail: These exploits will revolve around SSH keys as Lightsail does not have all the functionality of EC2

− EBS: Elastic Block Storage contains disks and snapshots of those disks; this will look for IAM keys that may be in those snapshots

− API Gateway: Adds API keys to allow you to get past the API gateway itself

You may often have to get around a security control, and some of these controls are provided by Amazon itself.

The AWS threat detection service is called GuardDuty. The workarounds below either allow your IP address or remove all logging so that GuardDuty is blind

− guardduty__whitelist_ip: This module adds your IP address to the GuardDuty whitelist. This will make it so that all your traffic is allowed

− detection__disruption: This module will detect which logging configurations are available such as VPC Flow Logs, CloudTrail, and CloudWatch. It will then disable these configurations or bring them down to their most basic level to eliminate logging