performing-aws-privilege-escalation-assessment

执行 AWS 权限提升评估

何时使用

• 在对 AWS IAM 配置进行授权渗透测试时
• 在验证 IAM 策略遵循最小权限原则时
• 在评估已泄露 AWS 凭证的影响范围时
• 在 CI/CD 流水线中为 IAM 角色和策略变更构建安全审查时
• 在评估跨账户信任关系的权限提升风险时

请勿使用于对 AWS 账户的未授权测试、评估非 IAM 攻击向量（SSRF、应用漏洞），或作为全面云渗透测试的替代方案。测试前务必获得书面授权。

前置条件

• 在目标 AWS 账户中进行权限提升测试的书面授权
• 具有有限权限的测试 IAM 用户或角色作为起点
• 已安装 Pacu（pip install pacu）
• 已安装 CloudFox（go install github.com/BishopFox/cloudfox@latest）
• 已安装 PMapper（Principal Mapper）（pip install principalmapper）
• 已配置测试凭证的 AWS CLI，并启用 CloudTrail 日志记录以形成审计追踪

工作流

步骤 1：枚举起始权限

在尝试权限提升之前，建立测试主体的基准权限。

# Get current identity
aws sts get-caller-identity

# Enumerate inline and attached policies for the current user
aws iam list-user-policies --user-name test-user
aws iam list-attached-user-policies --user-name test-user

# Get group memberships and group policies
aws iam list-groups-for-user --user-name test-user
for group in $(aws iam list-groups-for-user --user-name test-user --query 'Groups[*].GroupName' --output text); do
  echo "=== Group: $group ==="
  aws iam list-group-policies --group-name "$group"
  aws iam list-attached-group-policies --group-name "$group"
done

# Simulate specific API calls to map effective permissions
aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::ACCOUNT:user/test-user \
  --action-names iam:CreateUser iam:AttachUserPolicy iam:PassRole \
    lambda:CreateFunction ec2:RunInstances sts:AssumeRole \
  --query 'EvaluationResults[*].[EvalActionName,EvalDecision]' --output table

步骤 2：使用 Pacu 扫描权限提升路径

使用 Pacu 的权限提升扫描器识别已知的 IAM 提升技术。

# Start Pacu session
pacu

# Create session and set credentials
Pacu (new:session) > set_keys --key-alias privesc-test

# Enumerate IAM configuration
Pacu > run iam__enum_users_roles_policies_groups
Pacu > run iam__enum_permissions

# Run privilege escalation scanner
Pacu > run iam__privesc_scan

# The scanner checks for 21+ known escalation methods including:
# - iam:CreatePolicyVersion (create admin policy version)
# - iam:SetDefaultPolicyVersion (revert to permissive older version)
# - iam:AttachUserPolicy / iam:AttachRolePolicy (attach admin policy)
# - iam:PutUserPolicy / iam:PutRolePolicy (create inline admin policy)
# - iam:PassRole + lambda:CreateFunction (Lambda with admin role)
# - iam:PassRole + ec2:RunInstances (EC2 with admin instance profile)
# - iam:CreateLoginProfile / iam:UpdateLoginProfile (set console password)
# - iam:CreateAccessKey (create keys for other users)
# - sts:AssumeRole (assume more privileged roles)
# - glue:CreateDevEndpoint + iam:PassRole (Glue with admin role)

步骤 3：使用 PMapper 绘制权限提升图

使用 Principal Mapper 构建所有 IAM 主体的图，并识别提升边。

# Collect IAM data for graph construction
pmapper graph create --account ACCOUNT_ID

# Query for paths to admin
pmapper query 'who can do iam:AttachUserPolicy with * on *'
pmapper query 'who can do sts:AssumeRole with arn:aws:iam::ACCOUNT:role/AdminRole'

# Find all principals that can escalate to admin
pmapper analysis

# Visualize the privilege escalation graph
pmapper visualize --filetype png

# Check specific escalation paths
pmapper query 'can arn:aws:iam::ACCOUNT:user/test-user do iam:CreatePolicyVersion with *'
pmapper query 'can arn:aws:iam::ACCOUNT:user/test-user do sts:AssumeRole with arn:aws:iam::ACCOUNT:role/*'

步骤 4：测试跨账户角色代入

评估跨账户信任策略中配置错误的角色代入，这些代入允许未经授权的权限提升。

# List all roles and their trust policies
aws iam list-roles --query 'Roles[*].[RoleName,Arn]' --output text | while read name arn; do
  trust=$(aws iam get-role --role-name "$name" --query 'Role.AssumeRolePolicyDocument' --output json 2>/dev/null)
  # Check for wildcards or broad trust
  echo "$trust" | python3 -c "
import json, sys
doc = json.load(sys.stdin)
for stmt in doc.get('Statement', []):
    principal = stmt.get('Principal', {})
    condition = stmt.get('Condition', {})
    if isinstance(principal, dict):
        aws_princ = principal.get('AWS', '')
    else:
        aws_princ = principal
    if '*' in str(aws_princ) or 'root' in str(aws_princ):
        has_external_id = 'sts:ExternalId' in str(condition)
        has_mfa = 'aws:MultiFactorAuthPresent' in str(condition)
        print(f'ROLE: $name')
        print(f'  Principal: {aws_princ}')
        print(f'  ExternalId required: {has_external_id}')
        print(f'  MFA required: {has_mfa}')
        if not has_external_id and not has_mfa:
            print(f'  WARNING: No ExternalId or MFA condition - confused deputy risk')
" 2>/dev/null
done

# Test role assumption
aws sts assume-role \
  --role-arn arn:aws:iam::TARGET_ACCOUNT:role/CrossAccountRole \
  --role-session-name privesc-test \
  --duration-seconds 900

步骤 5：枚举 CloudFox 攻击路径

使用 CloudFox 识别其他攻击面，包括基于资源的策略和服务特定的提升路径。

# Run all CloudFox checks
cloudfox aws --profile target-account all-checks -o ./cloudfox-output/

# Specific privilege escalation checks
cloudfox aws --profile target-account permissions
cloudfox aws --profile target-account role-trusts
cloudfox aws --profile target-account access-keys
cloudfox aws --profile target-account env-vars  # Lambda environment variables with secrets
cloudfox aws --profile target-account instances  # EC2 with instance profiles
cloudfox aws --profile target-account endpoints  # Exposed services

步骤 6：记录发现与修复建议

汇总所有发现的提升路径，附上概念验证步骤和修复建议。

# Generate a consolidated report
cat > privesc-report.md << 'EOF'
# AWS Privilege Escalation Assessment Report

## Tested Escalation Vectors

| Vector | Status | Starting Principal | Escalated To | Risk |
|--------|--------|--------------------|--------------|------|
| iam:CreatePolicyVersion | EXPLOITABLE | test-user | AdministratorAccess | Critical |
| iam:PassRole + lambda:CreateFunction | EXPLOITABLE | dev-role | LambdaAdminRole | Critical |
| sts:AssumeRole (cross-account) | EXPLOITABLE | test-user | ProdAdminRole | High |
| iam:AttachUserPolicy | BLOCKED | test-user | N/A | N/A |
| ec2:RunInstances + iam:PassRole | BLOCKED | test-user | N/A | N/A |

## Remediation
1. Apply permission boundaries to all IAM users and roles
2. Remove iam:CreatePolicyVersion from non-admin principals
3. Add sts:ExternalId condition to all cross-account role trust policies
4. Implement SCP guardrails preventing privilege escalation actions
EOF

关键概念

术语	定义
IAM 权限提升	利用过于宽松的 IAM 策略，获取比主体最初被授予的更高层级访问权限
权限边界	设定主体可拥有的最大权限的 IAM 策略，无论附加到其上的基于身份的策略如何
iam:PassRole	允许主体将 IAM 角色传递给 AWS 服务的 IAM 操作，使该服务能够以该角色的权限执行操作
混淆代理	攻击者利用跨账户角色代入且无外部 ID 验证，诱骗受信任服务代表其执行操作的攻击
服务控制策略	AWS Organizations 策略，为成员账户设定最大权限，提供防止权限提升的护栏
Principal Mapper	开源工具，将 IAM 主体及其提升路径建模为有向图以进行分析

工具与系统

• Pacu：AWS 利用框架，具有 21+ 权限提升模块，用于自动化检测和利用
• Principal Mapper：基于图的 IAM 分析工具，绘制主体之间的提升路径
• CloudFox：AWS 枚举工具，专注于从攻击者视角识别攻击路径
• IAM Policy Simulator：AWS 原生工具，用于测试针对特定 API 操作的有效权限
• AWS Access Analyzer：识别授予外部访问权限的资源策略并验证 IAM 策略变更的服务

常见场景

场景：开发者角色拥有 iam:CreatePolicyVersion 导致管理员权限

背景：在一次授权评估中，测试人员发现某个开发者角色拥有 iam:CreatePolicyVersion 权限，该权限允许为任意客户管理策略创建带有任意权限的新版本。

方法：

1. 使用 Pacu 中的 iam__enum_permissions 枚举附加到开发者角色的策略
2. 确认该角色可以对其自身附加的策略调用 iam:CreatePolicyVersion
3. 创建一个新策略版本，包含 "Action": "*", "Resource": "*", "Effect": "Allow"
4. 将该新版本设为默认策略版本
5. 通过调用 iam:ListUsers、s3:ListBuckets 等验证管理员权限
6. 记录提权链，并建议移除 iam:CreatePolicyVersion 并实施权限边界

陷阱：AWS 将托管策略限制为 5 个版本。如果 5 个版本都已存在，必须先删除一个版本才能创建新版本。始终记录原始默认版本，以便在清理期间恢复它。如果配置正确，权限边界可以阻止这种提权，因此在宣布发现之前，请验证边界策略。

输出格式

AWS Privilege Escalation Assessment Report
=============================================
Account: 123456789012 (Production)
Assessment Date: 2026-02-23
Starting Principal: arn:aws:iam::123456789012:user/test-user
Starting Permissions: S3 read-only, Lambda invoke, EC2 describe
Authorization: Signed by CISO, engagement #PT-2026-014

ESCALATION PATHS DISCOVERED: 4

[PRIVESC-001] iam:CreatePolicyVersion -> Admin
  Severity: CRITICAL
  Starting Permission: iam:CreatePolicyVersion on policy/dev-policy
  Escalation: Created policy version 6 with Action:* Resource:*
  Time to Exploit: < 2 minutes
  Remediation: Remove iam:CreatePolicyVersion, apply permission boundary

[PRIVESC-002] iam:PassRole + lambda:CreateFunction -> LambdaAdminRole
  Severity: CRITICAL
  Starting Permission: iam:PassRole, lambda:CreateFunction
  Escalation: Created Lambda function with AdminRole, invoked to get admin credentials
  Time to Exploit: < 5 minutes
  Remediation: Restrict iam:PassRole to specific role ARNs with condition key

[PRIVESC-003] sts:AssumeRole -> Cross-Account Admin
  Severity: HIGH
  Starting Permission: sts:AssumeRole on arn:aws:iam::987654321098:role/SharedRole
  Escalation: Role trust policy allows any principal in source account
  Remediation: Add sts:ExternalId condition and restrict Principal to specific roles

TOTAL ESCALATION PATHS: 4 (2 Critical, 1 High, 1 Medium)
PERMISSION BOUNDARIES IN PLACE: 0 / 47 IAM principals
SCP GUARDRAILS BLOCKING ESCALATION: 0 / 3 tested vectors