CloudBashing for mining, networking, exfil, persistence

The talk opens with what a cloud shell is: a browser terminal attached to a backend container, with a preinstalled CLI and the user's credentials already bound to it. The speakers explain that the work began with a CTF they built for a previous DEF CON, where the flag lived inside a cloud shell. Sniffing the browser traffic led them to reverse the private REST and websocket protocols used by all three major clouds, and to trace how credentials move from console logins to temporary tokens.

The middle of the talk covers what the reversed API makes possible. A terminal tool built on it can provision large numbers of containers from one credential. In AWS, each region gets its own cloud shell, and federation calls that accept arbitrary session names let a single identity create many more, so the speakers reached 160 nodes. Because no CPU metering or billing alert catches this, cryptomining goes unnoticed. The team also showed a file-download path that runs curl inside the container, which could be hijacked to swap in a trojanized script and capture credentials. Storage can be spread across regions, websocket sessions can outlive token revocation through idle-reset pings, and Microsoft device-code flows and free consumer Gmail accounts can reach the service.

The closing takeaways are that these containers are unmanaged, hard to audit, and easy to forget during incident response. The speakers suggest disabling cloud shells where they are not needed, and otherwise treating them as assets that need their own controls and monitoring. They also released a toolkit, CloudBasher, for enumerating and running distributed workloads across these environments.