Using Barq to Perform AWS Post-Exploitation
Mohammed Aldoub presents Barq, an AWS post-exploitation framework that automates attacking live EC2 instances and dumping SSM Parameter Store secrets.
Summary
The Need for Automated AWS Post-Exploitation Frameworks
Once initial AWS credentials are compromised, red team operators require specialized tooling to enumerate assets, extract secrets, and pivot across cloud instances.
Introducing the Barq Post-Exploitation Toolkit
Mohammed Aldoub introduces Barq, an open-source offensive framework designed to execute automated attacks against running AWS infrastructure.
Attacking EC2 Instances Without SSH Keys
Aldoub demonstrates how Barq abuses AWS Systems Manager (SSM) and EC2 user-data scripts to execute root shellcode on running instances without requiring SSH keypairs.
Automated Secret Extraction and Defense Mitigations
The author showcases dumping stored AWS Secrets Manager and SSM Parameters, concluding with defensive IAM policies to restrict SSM Agent abuse.
Related talks
Main Stage·16 min
Scott Taylor
Scott Taylor introduces C4, an open-source framework decoupling payload implants from command-and-control protocols using versatile external connectors.
Main Stage·52 min
Cedric Owens
Cedric Owens details modern attack paths in non-Active Directory macOS environments, including Gatekeeper bypasses, cloud IdaaS targeting, and post-exploitation tradecraft.
Demo Labs·20 min
Starkiller
A walkthrough of Starkiller, a graphical user interface frontend for managing PowerShell Empire post-exploitation agents and operations.