Andres Riancho - Step by step AWS Cloud Hacking

## Overview Andrés Riancho, Head of Information Security at Walt Efe Studios, presents a comprehensive step-by-step demonstration of AWS cloud exploitation techniques. The talk progresses from initial reconnaissance to full account compromise in approximately 45 minutes, illustrating how an attacker with zero knowledge of infrastructure can achieve complete access.

## Key Topics **Initial Access via SSRF**: The attack begins by exploiting a Server-Side Request Forgery (SSRF) vulnerability in a web application running on an EC2 instance. The attacker uses this to access the AWS instance metadata service (IMDSv1) at 169.254.169.254, bypassing network boundaries that should restrict metadata access to only the instance itself.

**Credential Extraction**: Once metadata access is gained, the attacker extracts temporary AWS credentials (access key, secret key, and session token) associated with the EC2 instance's IAM role. These credentials are then configured for use with AWS CLI tools.

**Permission Enumeration**: The talk demonstrates two approaches to understand available permissions. The first (IAM GetUser) typically fails due to insufficient permissions, so the attacker uses brute-force enumeration via API calls. Riancho developed his own tool, "Enumerate IAM," which supports multi-threading and all AWS services (unlike Pacu, which only supports EC2 and S3).

**Lambda Exploitation and Escalation**: Discovery of a Lambda function (named "monitoring") with an attached IAM role presents an escalation opportunity. The attacker creates a new Lambda function assuming the monitoring role, which returns elevated credentials. This escalates access from the limited web application role to the more privileged monitoring role.

**Role Trust Policy Abuse**: Further enumeration reveals an admin role with a trust policy allowing cross-account access. The attacker identifies that the monitoring role has permissions to modify trust policies, enabling privilege escalation to the admin role with broad permissions.

**Persistence Mechanisms**: Two backdoors are installed to maintain access. The first modifies the admin role's trust policy to include the attacker's AWS account as a principal. The second uses CloudWatch EventBridge with a Lambda trigger to automatically inject malicious trust policy statements into any newly created or modified IAM role, ensuring persistence even if initial changes are discovered and reverted.

**Private Network Access**: After gaining control of the AWS account's IAM plane, the attacker discovers private EC2 instances in different VPCs. Using Riancho's "PC VPN" tool, the attacker automates VPN server creation using AWS VPC services, then connects via OpenVPN to access previously unreachable private instances and sensitive data.

## Technical Details The attack relies on well-known but impactful weaknesses: credentials stored in application code or environment variables; lack of IMDSv2 enforcement (which requires signed requests); overly permissive IAM policies; and insufficient monitoring of role modifications. The tools demonstrated (W3AF scanner, AWS CLI, Pacu, and Riancho's custom tools) are either publicly available or published on the speaker's website. No zero-day exploits or magic techniques are involved—the attack chain leverages standard AWS features and common misconfigurations.

## Takeaways - Enforce IMDSv2 to prevent SSRF-based credential theft - Implement strict least-privilege IAM policies and regular audits - Monitor and alert on IAM role modifications, especially trust policy changes - Segment private VPC networks and monitor for unauthorized VPN creation - Validate application code for SSRF vulnerabilities before deployment - Consider credential management alternatives (e.g., AWS Secrets Manager) over environment variables - Enable CloudTrail logging and establish baselines for unusual API activity