[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFN81JX6SF5GN6W21VB3CW":3,"skill-same:01M6AFN81JX6SF5GN6W21VB3CW":103},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":62,"commitSha":63,"skillDirectory":64,"forksCount":65,"repositoryHtmlUrl":66,"repositoryHomepageUrl":67,"ownerHtmlUrl":68,"ownerBlogUrl":69,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6AFN81JX6SF5GN6W21VB3CW","performing-aws-privilege-escalation-assessment",null,"Performing authorized privilege escalation assessments in AWS environments to identify IAM misconfigurations that allow users or roles to elevate their permissions using Pacu, CloudFox, Principal Mapper, and manual IAM policy analysis techniques.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35990,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-aws-privilege-escalation-assessment\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"aws","performing aws privilege escalation assessment","escalation","assessment","pr","permissions","cloud","privilege-escalation","cloud-security","security","iam","cybersecurity","offensive-security","t1078","cloudfox","pacu","analysis","policy","2026-11-10 10:12:30",false,"---\nname: performing-aws-privilege-escalation-assessment\ndescription: 'Performing authorized privilege escalation assessments in AWS environments\n  to identify IAM misconfigurations that allow users or roles to elevate their permissions\n  using Pacu, CloudFox, Principal Mapper, and manual IAM policy analysis techniques.\n\n  '\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cloud-security\n- aws\n- privilege-escalation\n- iam\n- pacu\n- offensive-security\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1078.004\n- T1530\n- T1537\n- T1580\n- T1068\n---\n\n# Performing AWS Privilege Escalation Assessment\n\n## When to Use\n\n- When conducting authorized penetration testing of AWS IAM configurations\n- When validating that IAM policies follow the principle of least privilege\n- When assessing the blast radius of a compromised AWS credential\n- When building security reviews for IAM role and policy changes in CI\u002FCD pipelines\n- When evaluating cross-account trust relationships for privilege escalation risks\n\n**Do not use** for unauthorized testing against AWS accounts, for assessing non-IAM attack vectors (SSRF, application vulnerabilities), or as a substitute for comprehensive cloud penetration testing. Always obtain written authorization before testing.\n\n## Prerequisites\n\n- Written authorization for privilege escalation testing in the target AWS account\n- Test IAM user or role with limited permissions as the starting point\n- Pacu installed (`pip install pacu`)\n- CloudFox installed (`go install github.com\u002FBishopFox\u002Fcloudfox@latest`)\n- PMapper (Principal Mapper) installed (`pip install principalmapper`)\n- AWS CLI configured with test credentials and CloudTrail logging enabled for audit trail\n\n## Workflow\n\n### Step 1: Enumerate Starting Permissions\n\nEstablish the baseline permissions of the test principal before attempting escalation.\n\n```bash\n# Get current identity\naws sts get-caller-identity\n\n# Enumerate inline and attached policies for the current user\naws iam list-user-policies --user-name test-user\naws iam list-attached-user-policies --user-name test-user\n\n# Get group memberships and group policies\naws iam list-groups-for-user --user-name test-user\nfor group in $(aws iam list-groups-for-user --user-name test-user --query 'Groups[*].GroupName' --output text); do\n  echo \"=== Group: $group ===\"\n  aws iam list-group-policies --group-name \"$group\"\n  aws iam list-attached-group-policies --group-name \"$group\"\ndone\n\n# Simulate specific API calls to map effective permissions\naws iam simulate-principal-policy \\\n  --policy-source-arn arn:aws:iam::ACCOUNT:user\u002Ftest-user \\\n  --action-names iam:CreateUser iam:AttachUserPolicy iam:PassRole \\\n    lambda:CreateFunction ec2:RunInstances sts:AssumeRole \\\n  --query 'EvaluationResults[*].[EvalActionName,EvalDecision]' --output table\n```\n\n### Step 2: Scan for Privilege Escalation Paths with Pacu\n\nUse Pacu's privilege escalation scanner to identify known IAM escalation techniques.\n\n```bash\n# Start Pacu session\npacu\n\n# Create session and set credentials\nPacu (new:session) > set_keys --key-alias privesc-test\n\n# Enumerate IAM configuration\nPacu > run iam__enum_users_roles_policies_groups\nPacu > run iam__enum_permissions\n\n# Run privilege escalation scanner\nPacu > run iam__privesc_scan\n\n# The scanner checks for 21+ known escalation methods including:\n# - iam:CreatePolicyVersion (create admin policy version)\n# - iam:SetDefaultPolicyVersion (revert to permissive older version)\n# - iam:AttachUserPolicy \u002F iam:AttachRolePolicy (attach admin policy)\n# - iam:PutUserPolicy \u002F iam:PutRolePolicy (create inline admin policy)\n# - iam:PassRole + lambda:CreateFunction (Lambda with admin role)\n# - iam:PassRole + ec2:RunInstances (EC2 with admin instance profile)\n# - iam:CreateLoginProfile \u002F iam:UpdateLoginProfile (set console password)\n# - iam:CreateAccessKey (create keys for other users)\n# - sts:AssumeRole (assume more privileged roles)\n# - glue:CreateDevEndpoint + iam:PassRole (Glue with admin role)\n```\n\n### Step 3: Map Privilege Escalation Graphs with PMapper\n\nUse Principal Mapper to build a graph of all IAM principals and identify escalation edges.\n\n```bash\n# Collect IAM data for graph construction\npmapper graph create --account ACCOUNT_ID\n\n# Query for paths to admin\npmapper query 'who can do iam:AttachUserPolicy with * on *'\npmapper query 'who can do sts:AssumeRole with arn:aws:iam::ACCOUNT:role\u002FAdminRole'\n\n# Find all principals that can escalate to admin\npmapper analysis\n\n# Visualize the privilege escalation graph\npmapper visualize --filetype png\n\n# Check specific escalation paths\npmapper query 'can arn:aws:iam::ACCOUNT:user\u002Ftest-user do iam:CreatePolicyVersion with *'\npmapper query 'can arn:aws:iam::ACCOUNT:user\u002Ftest-user do sts:AssumeRole with arn:aws:iam::ACCOUNT:role\u002F*'\n```\n\n### Step 4: Test Cross-Account Role Assumption\n\nEvaluate cross-account trust policies for misconfigured role assumptions that allow unauthorized escalation.\n\n```bash\n# List all roles and their trust policies\naws iam list-roles --query 'Roles[*].[RoleName,Arn]' --output text | while read name arn; do\n  trust=$(aws iam get-role --role-name \"$name\" --query 'Role.AssumeRolePolicyDocument' --output json 2>\u002Fdev\u002Fnull)\n  # Check for wildcards or broad trust\n  echo \"$trust\" | python3 -c \"\nimport json, sys\ndoc = json.load(sys.stdin)\nfor stmt in doc.get('Statement', []):\n    principal = stmt.get('Principal', {})\n    condition = stmt.get('Condition', {})\n    if isinstance(principal, dict):\n        aws_princ = principal.get('AWS', '')\n    else:\n        aws_princ = principal\n    if '*' in str(aws_princ) or 'root' in str(aws_princ):\n        has_external_id = 'sts:ExternalId' in str(condition)\n        has_mfa = 'aws:MultiFactorAuthPresent' in str(condition)\n        print(f'ROLE: $name')\n        print(f'  Principal: {aws_princ}')\n        print(f'  ExternalId required: {has_external_id}')\n        print(f'  MFA required: {has_mfa}')\n        if not has_external_id and not has_mfa:\n            print(f'  WARNING: No ExternalId or MFA condition - confused deputy risk')\n\" 2>\u002Fdev\u002Fnull\ndone\n\n# Test role assumption\naws sts assume-role \\\n  --role-arn arn:aws:iam::TARGET_ACCOUNT:role\u002FCrossAccountRole \\\n  --role-session-name privesc-test \\\n  --duration-seconds 900\n```\n\n### Step 5: Enumerate CloudFox Attack Paths\n\nUse CloudFox to identify additional attack surfaces including resource-based policies and service-specific escalation paths.\n\n```bash\n# Run all CloudFox checks\ncloudfox aws --profile target-account all-checks -o .\u002Fcloudfox-output\u002F\n\n# Specific privilege escalation checks\ncloudfox aws --profile target-account permissions\ncloudfox aws --profile target-account role-trusts\ncloudfox aws --profile target-account access-keys\ncloudfox aws --profile target-account env-vars  # Lambda environment variables with secrets\ncloudfox aws --profile target-account instances  # EC2 with instance profiles\ncloudfox aws --profile target-account endpoints  # Exposed services\n```\n\n### Step 6: Document Findings and Remediation\n\nCompile all discovered escalation paths with proof-of-concept steps and remediation recommendations.\n\n```bash\n# Generate a consolidated report\ncat > privesc-report.md \u003C\u003C 'EOF'\n# AWS Privilege Escalation Assessment Report\n\n## Tested Escalation Vectors\n\n| Vector | Status | Starting Principal | Escalated To | Risk |\n|--------|--------|--------------------|--------------|------|\n| iam:CreatePolicyVersion | EXPLOITABLE | test-user | AdministratorAccess | Critical |\n| iam:PassRole + lambda:CreateFunction | EXPLOITABLE | dev-role | LambdaAdminRole | Critical |\n| sts:AssumeRole (cross-account) | EXPLOITABLE | test-user | ProdAdminRole | High |\n| iam:AttachUserPolicy | BLOCKED | test-user | N\u002FA | N\u002FA |\n| ec2:RunInstances + iam:PassRole | BLOCKED | test-user | N\u002FA | N\u002FA |\n\n## Remediation\n1. Apply permission boundaries to all IAM users and roles\n2. Remove iam:CreatePolicyVersion from non-admin principals\n3. Add sts:ExternalId condition to all cross-account role trust policies\n4. Implement SCP guardrails preventing privilege escalation actions\nEOF\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| IAM Privilege Escalation | Exploiting overly permissive IAM policies to gain higher-level access than originally granted to a principal |\n| Permission Boundary | IAM policy that sets the maximum permissions a principal can have, regardless of identity-based policies attached to it |\n| iam:PassRole | IAM action allowing a principal to pass an IAM role to an AWS service, enabling the service to act with that role's permissions |\n| Confused Deputy | Attack where an attacker tricks a trusted service into performing actions on their behalf using cross-account role assumption without external ID validation |\n| Service Control Policy | AWS Organizations policy that sets maximum permissions for member accounts, providing guardrails against privilege escalation |\n| Principal Mapper | Open-source tool that models IAM principals and their escalation paths as a directed graph for analysis |\n\n## Tools & Systems\n\n- **Pacu**: AWS exploitation framework with 21+ privilege escalation modules for automated detection and exploitation\n- **Principal Mapper**: Graph-based IAM analysis tool that maps escalation paths between principals\n- **CloudFox**: AWS enumeration tool focused on identifying attack paths from an attacker's perspective\n- **IAM Policy Simulator**: AWS-native tool for testing effective permissions against specific API actions\n- **AWS Access Analyzer**: Service that identifies resource policies granting external access and validates IAM policy changes\n\n## Common Scenarios\n\n### Scenario: Developer Role with iam:CreatePolicyVersion Leads to Admin Access\n\n**Context**: During an authorized assessment, a tester discovers that a developer role has the `iam:CreatePolicyVersion` permission, which allows creating a new version of any customer-managed policy with arbitrary permissions.\n\n**Approach**:\n1. Enumerate policies attached to the developer role using `iam__enum_permissions` in Pacu\n2. Identify that the role can call `iam:CreatePolicyVersion` on its own attached policy\n3. Create a new policy version with `\"Action\": \"*\", \"Resource\": \"*\", \"Effect\": \"Allow\"`\n4. Set the new version as the default policy version\n5. Verify admin access by calling `iam:ListUsers`, `s3:ListBuckets`, etc.\n6. Document the escalation chain and recommend removing `iam:CreatePolicyVersion` and implementing permission boundaries\n\n**Pitfalls**: AWS limits managed policies to 5 versions. If all 5 exist, you must delete a version before creating a new one. Always record the original default version to restore it during cleanup. Permission boundaries prevent this escalation if properly configured, so verify boundary policies before declaring a finding.\n\n## Output Format\n\n```\nAWS Privilege Escalation Assessment Report\n=============================================\nAccount: 123456789012 (Production)\nAssessment Date: 2026-02-23\nStarting Principal: arn:aws:iam::123456789012:user\u002Ftest-user\nStarting Permissions: S3 read-only, Lambda invoke, EC2 describe\nAuthorization: Signed by CISO, engagement #PT-2026-014\n\nESCALATION PATHS DISCOVERED: 4\n\n[PRIVESC-001] iam:CreatePolicyVersion -> Admin\n  Severity: CRITICAL\n  Starting Permission: iam:CreatePolicyVersion on policy\u002Fdev-policy\n  Escalation: Created policy version 6 with Action:* Resource:*\n  Time to Exploit: \u003C 2 minutes\n  Remediation: Remove iam:CreatePolicyVersion, apply permission boundary\n\n[PRIVESC-002] iam:PassRole + lambda:CreateFunction -> LambdaAdminRole\n  Severity: CRITICAL\n  Starting Permission: iam:PassRole, lambda:CreateFunction\n  Escalation: Created Lambda function with AdminRole, invoked to get admin credentials\n  Time to Exploit: \u003C 5 minutes\n  Remediation: Restrict iam:PassRole to specific role ARNs with condition key\n\n[PRIVESC-003] sts:AssumeRole -> Cross-Account Admin\n  Severity: HIGH\n  Starting Permission: sts:AssumeRole on arn:aws:iam::987654321098:role\u002FSharedRole\n  Escalation: Role trust policy allows any principal in source account\n  Remediation: Add sts:ExternalId condition and restrict Principal to specific roles\n\nTOTAL ESCALATION PATHS: 4 (2 Critical, 1 High, 1 Medium)\nPERMISSION BOUNDARIES IN PLACE: 0 \u002F 47 IAM principals\nSCP GUARDRAILS BLOCKING ESCALATION: 0 \u002F 3 tested vectors\n```\n","# Performing AWS Privilege Escalation Assessment\n\n## When to Use\n\n- When conducting authorized penetration testing of AWS IAM configurations\n- When validating that IAM policies follow the principle of least privilege\n- When assessing the blast radius of a compromised AWS credential\n- When building security reviews for IAM role and policy changes in CI\u002FCD pipelines\n- When evaluating cross-account trust relationships for privilege escalation risks\n\n**Do not use** for unauthorized testing against AWS accounts, for assessing non-IAM attack vectors (SSRF, application vulnerabilities), or as a substitute for comprehensive cloud penetration testing. Always obtain written authorization before testing.\n\n## Prerequisites\n\n- Written authorization for privilege escalation testing in the target AWS account\n- Test IAM user or role with limited permissions as the starting point\n- Pacu installed (`pip install pacu`)\n- CloudFox installed (`go install github.com\u002FBishopFox\u002Fcloudfox@latest`)\n- PMapper (Principal Mapper) installed (`pip install principalmapper`)\n- AWS CLI configured with test credentials and CloudTrail logging enabled for audit trail\n\n## Workflow\n\n### Step 1: Enumerate Starting Permissions\n\nEstablish the baseline permissions of the test principal before attempting escalation.\n\n```bash\n# Get current identity\naws sts get-caller-identity\n\n# Enumerate inline and attached policies for the current user\naws iam list-user-policies --user-name test-user\naws iam list-attached-user-policies --user-name test-user\n\n# Get group memberships and group policies\naws iam list-groups-for-user --user-name test-user\nfor group in $(aws iam list-groups-for-user --user-name test-user --query 'Groups[*].GroupName' --output text); do\n  echo \"=== Group: $group ===\"\n  aws iam list-group-policies --group-name \"$group\"\n  aws iam list-attached-group-policies --group-name \"$group\"\ndone\n\n# Simulate specific API calls to map effective permissions\naws iam simulate-principal-policy \\\n  --policy-source-arn arn:aws:iam::ACCOUNT:user\u002Ftest-user \\\n  --action-names iam:CreateUser iam:AttachUserPolicy iam:PassRole \\\n    lambda:CreateFunction ec2:RunInstances sts:AssumeRole \\\n  --query 'EvaluationResults[*].[EvalActionName,EvalDecision]' --output table\n```\n\n### Step 2: Scan for Privilege Escalation Paths with Pacu\n\nUse Pacu's privilege escalation scanner to identify known IAM escalation techniques.\n\n```bash\n# Start Pacu session\npacu\n\n# Create session and set credentials\nPacu (new:session) > set_keys --key-alias privesc-test\n\n# Enumerate IAM configuration\nPacu > run iam__enum_users_roles_policies_groups\nPacu > run iam__enum_permissions\n\n# Run privilege escalation scanner\nPacu > run iam__privesc_scan\n\n# The scanner checks for 21+ known escalation methods including:\n# - iam:CreatePolicyVersion (create admin policy version)\n# - iam:SetDefaultPolicyVersion (revert to permissive older version)\n# - iam:AttachUserPolicy \u002F iam:AttachRolePolicy (attach admin policy)\n# - iam:PutUserPolicy \u002F iam:PutRolePolicy (create inline admin policy)\n# - iam:PassRole + lambda:CreateFunction (Lambda with admin role)\n# - iam:PassRole + ec2:RunInstances (EC2 with admin instance profile)\n# - iam:CreateLoginProfile \u002F iam:UpdateLoginProfile (set console password)\n# - iam:CreateAccessKey (create keys for other users)\n# - sts:AssumeRole (assume more privileged roles)\n# - glue:CreateDevEndpoint + iam:PassRole (Glue with admin role)\n```\n\n### Step 3: Map Privilege Escalation Graphs with PMapper\n\nUse Principal Mapper to build a graph of all IAM principals and identify escalation edges.\n\n```bash\n# Collect IAM data for graph construction\npmapper graph create --account ACCOUNT_ID\n\n# Query for paths to admin\npmapper query 'who can do iam:AttachUserPolicy with * on *'\npmapper query 'who can do sts:AssumeRole with arn:aws:iam::ACCOUNT:role\u002FAdminRole'\n\n# Find all principals that can escalate to admin\npmapper analysis\n\n# Visualize the privilege escalation graph\npmapper visualize --filetype png\n\n# Check specific escalation paths\npmapper query 'can arn:aws:iam::ACCOUNT:user\u002Ftest-user do iam:CreatePolicyVersion with *'\npmapper query 'can arn:aws:iam::ACCOUNT:user\u002Ftest-user do sts:AssumeRole with arn:aws:iam::ACCOUNT:role\u002F*'\n```\n\n### Step 4: Test Cross-Account Role Assumption\n\nEvaluate cross-account trust policies for misconfigured role assumptions that allow unauthorized escalation.\n\n```bash\n# List all roles and their trust policies\naws iam list-roles --query 'Roles[*].[RoleName,Arn]' --output text | while read name arn; do\n  trust=$(aws iam get-role --role-name \"$name\" --query 'Role.AssumeRolePolicyDocument' --output json 2>\u002Fdev\u002Fnull)\n  # Check for wildcards or broad trust\n  echo \"$trust\" | python3 -c \"\nimport json, sys\ndoc = json.load(sys.stdin)\nfor stmt in doc.get('Statement', []):\n    principal = stmt.get('Principal', {})\n    condition = stmt.get('Condition', {})\n    if isinstance(principal, dict):\n        aws_princ = principal.get('AWS', '')\n    else:\n        aws_princ = principal\n    if '*' in str(aws_princ) or 'root' in str(aws_princ):\n        has_external_id = 'sts:ExternalId' in str(condition)\n        has_mfa = 'aws:MultiFactorAuthPresent' in str(condition)\n        print(f'ROLE: $name')\n        print(f'  Principal: {aws_princ}')\n        print(f'  ExternalId required: {has_external_id}')\n        print(f'  MFA required: {has_mfa}')\n        if not has_external_id and not has_mfa:\n            print(f'  WARNING: No ExternalId or MFA condition - confused deputy risk')\n\" 2>\u002Fdev\u002Fnull\ndone\n\n# Test role assumption\naws sts assume-role \\\n  --role-arn arn:aws:iam::TARGET_ACCOUNT:role\u002FCrossAccountRole \\\n  --role-session-name privesc-test \\\n  --duration-seconds 900\n```\n\n### Step 5: Enumerate CloudFox Attack Paths\n\nUse CloudFox to identify additional attack surfaces including resource-based policies and service-specific escalation paths.\n\n```bash\n# Run all CloudFox checks\ncloudfox aws --profile target-account all-checks -o .\u002Fcloudfox-output\u002F\n\n# Specific privilege escalation checks\ncloudfox aws --profile target-account permissions\ncloudfox aws --profile target-account role-trusts\ncloudfox aws --profile target-account access-keys\ncloudfox aws --profile target-account env-vars  # Lambda environment variables with secrets\ncloudfox aws --profile target-account instances  # EC2 with instance profiles\ncloudfox aws --profile target-account endpoints  # Exposed services\n```\n\n### Step 6: Document Findings and Remediation\n\nCompile all discovered escalation paths with proof-of-concept steps and remediation recommendations.\n\n```bash\n# Generate a consolidated report\ncat > privesc-report.md \u003C\u003C 'EOF'\n# AWS Privilege Escalation Assessment Report\n\n## Tested Escalation Vectors\n\n| Vector | Status | Starting Principal | Escalated To | Risk |\n|--------|--------|--------------------|--------------|------|\n| iam:CreatePolicyVersion | EXPLOITABLE | test-user | AdministratorAccess | Critical |\n| iam:PassRole + lambda:CreateFunction | EXPLOITABLE | dev-role | LambdaAdminRole | Critical |\n| sts:AssumeRole (cross-account) | EXPLOITABLE | test-user | ProdAdminRole | High |\n| iam:AttachUserPolicy | BLOCKED | test-user | N\u002FA | N\u002FA |\n| ec2:RunInstances + iam:PassRole | BLOCKED | test-user | N\u002FA | N\u002FA |\n\n## Remediation\n1. Apply permission boundaries to all IAM users and roles\n2. Remove iam:CreatePolicyVersion from non-admin principals\n3. Add sts:ExternalId condition to all cross-account role trust policies\n4. Implement SCP guardrails preventing privilege escalation actions\nEOF\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| IAM Privilege Escalation | Exploiting overly permissive IAM policies to gain higher-level access than originally granted to a principal |\n| Permission Boundary | IAM policy that sets the maximum permissions a principal can have, regardless of identity-based policies attached to it |\n| iam:PassRole | IAM action allowing a principal to pass an IAM role to an AWS service, enabling the service to act with that role's permissions |\n| Confused Deputy | Attack where an attacker tricks a trusted service into performing actions on their behalf using cross-account role assumption without external ID validation |\n| Service Control Policy | AWS Organizations policy that sets maximum permissions for member accounts, providing guardrails against privilege escalation |\n| Principal Mapper | Open-source tool that models IAM principals and their escalation paths as a directed graph for analysis |\n\n## Tools & Systems\n\n- **Pacu**: AWS exploitation framework with 21+ privilege escalation modules for automated detection and exploitation\n- **Principal Mapper**: Graph-based IAM analysis tool that maps escalation paths between principals\n- **CloudFox**: AWS enumeration tool focused on identifying attack paths from an attacker's perspective\n- **IAM Policy Simulator**: AWS-native tool for testing effective permissions against specific API actions\n- **AWS Access Analyzer**: Service that identifies resource policies granting external access and validates IAM policy changes\n\n## Common Scenarios\n\n### Scenario: Developer Role with iam:CreatePolicyVersion Leads to Admin Access\n\n**Context**: During an authorized assessment, a tester discovers that a developer role has the `iam:CreatePolicyVersion` permission, which allows creating a new version of any customer-managed policy with arbitrary permissions.\n\n**Approach**:\n1. Enumerate policies attached to the developer role using `iam__enum_permissions` in Pacu\n2. Identify that the role can call `iam:CreatePolicyVersion` on its own attached policy\n3. Create a new policy version with `\"Action\": \"*\", \"Resource\": \"*\", \"Effect\": \"Allow\"`\n4. Set the new version as the default policy version\n5. Verify admin access by calling `iam:ListUsers`, `s3:ListBuckets`, etc.\n6. Document the escalation chain and recommend removing `iam:CreatePolicyVersion` and implementing permission boundaries\n\n**Pitfalls**: AWS limits managed policies to 5 versions. If all 5 exist, you must delete a version before creating a new one. Always record the original default version to restore it during cleanup. Permission boundaries prevent this escalation if properly configured, so verify boundary policies before declaring a finding.\n\n## Output Format\n\n```\nAWS Privilege Escalation Assessment Report\n=============================================\nAccount: 123456789012 (Production)\nAssessment Date: 2026-02-23\nStarting Principal: arn:aws:iam::123456789012:user\u002Ftest-user\nStarting Permissions: S3 read-only, Lambda invoke, EC2 describe\nAuthorization: Signed by CISO, engagement #PT-2026-014\n\nESCALATION PATHS DISCOVERED: 4\n\n[PRIVESC-001] iam:CreatePolicyVersion -> Admin\n  Severity: CRITICAL\n  Starting Permission: iam:CreatePolicyVersion on policy\u002Fdev-policy\n  Escalation: Created policy version 6 with Action:* Resource:*\n  Time to Exploit: \u003C 2 minutes\n  Remediation: Remove iam:CreatePolicyVersion, apply permission boundary\n\n[PRIVESC-002] iam:PassRole + lambda:CreateFunction -> LambdaAdminRole\n  Severity: CRITICAL\n  Starting Permission: iam:PassRole, lambda:CreateFunction\n  Escalation: Created Lambda function with AdminRole, invoked to get admin credentials\n  Time to Exploit: \u003C 5 minutes\n  Remediation: Restrict iam:PassRole to specific role ARNs with condition key\n\n[PRIVESC-003] sts:AssumeRole -> Cross-Account Admin\n  Severity: HIGH\n  Starting Permission: sts:AssumeRole on arn:aws:iam::987654321098:role\u002FSharedRole\n  Escalation: Role trust policy allows any principal in source account\n  Remediation: Add sts:ExternalId condition and restrict Principal to specific roles\n\nTOTAL ESCALATION PATHS: 4 (2 Critical, 1 High, 1 Medium)\nPERMISSION BOUNDARIES IN PLACE: 0 \u002F 47 IAM principals\nSCP GUARDRAILS BLOCKING ESCALATION: 0 \u002F 3 tested vectors\n```\n",{"name":5,"tags":47,"author":48,"domain":35,"license":15,"version":49,"nist_csf":50,"subdomain":32,"description":55,"mitre_attack":56},[32,24,31,34,39,36],"mahipal","1.0",[51,52,53,54],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01","Performing authorized privilege escalation assessments in AWS environments to identify IAM misconfigurations that allow users or roles to elevate their permissions using Pacu, CloudFox, Principal Mapper, and manual IAM policy analysis techniques.\n",[57,58,59,60,61],"T1078.004","T1530","T1537","T1580","T1068","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fperforming-aws-privilege-escalation-assessment",4395,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-aws-privilege-escalation-assessment",{"tool":78,"command":79},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-aws-privilege-escalation-assessment",{"tool":81,"command":82},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill performing-aws-privilege-escalation-assessment","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-aws-privilege-escalation-assessment\u002FSKILL.md",true,[86,91,97],{"path":87,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-aws-privilege-escalation-assessment\u002FLICENSE",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fapi-reference.md","REFERENCE","参考文档",2653,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-aws-privilege-escalation-assessment\u002Freferences\u002Fapi-reference.md",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fagent.py","SCRIPT","脚本",7634,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fperforming-aws-privilege-escalation-assessment\u002Fscripts\u002Fagent.py",[104,129,152,179,205,232],{"skillNo":105,"name":106,"nameZh":6,"description":107,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":108,"categories":109,"keywords":111,"publishedAt":42},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[110],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[112,113,114,115,33,35,116,117,28,118,119,120,121,122,123,124,125,126,127,128],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":136,"publishedAt":42},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[135],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[137,125,138,139,33,41,35,28,140,141,142,143,144,145,146,147,148,149,150,151],"boot","TPM","validating tpm measured boot attestation","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":153,"name":154,"nameZh":6,"description":155,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":162,"publishedAt":42},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[158,161],{"categoryNo":159,"categoryName":160,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[146,163,164,165,166,35,167,168,140,169,170,171,172,173,174,37,175,176,177,178],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":180,"name":181,"nameZh":6,"description":182,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":183,"categories":184,"keywords":186,"publishedAt":42},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[185],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[187,188,189,35,190,191,192,193,194,195,196,197,198,199,200,201,143,202,203,204],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":206,"name":207,"nameZh":6,"description":208,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":209,"categories":210,"keywords":212,"publishedAt":42},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[211],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[213,214,215,35,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":233,"name":234,"nameZh":6,"description":235,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":236,"categories":237,"keywords":239,"publishedAt":42},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[238],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[33,240,35,241,242,243,244,245,246,247,248,37,249,175,40,250,251,252,253,254],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]