← marwandiallo.comlabs

IAM Privilege Escalation

A live cloud-IAM attack-path enumerator. Each scenario seeds a small directory of users, roles, groups, and service principals; the engine derives every attack edge from the permissions held, then enumerates every path from the starting principal to admin.

How this works. The engine knows 14 published techniques across AWS, Azure, and GCP and BFSes the derived edges looking for paths to the admin sentinel.

Scenarios

Setup. A developer user is granted iam:PassRole + ec2:RunInstances + ssm:StartSession 'for debugging'. There's an unrelated EC2-Admin role. The developer can launch an instance carrying that role and SSM in.

Starting principal: user/dev-alice

reference: Rhino Security Labs, AWS Privilege Escalation Methods (2018) — Method 8

Principals (editable)

Attack paths to admin (1)

path #1
  1. user/dev-alice
  2. iam:PassRole + ec2:RunInstances → instance with admin role → role/EC2-Admin
    Run an EC2 instance with role role/EC2-Admin attached, then read IMDS.
  3. implicit-admin → admin
    role/EC2-Admin already holds an admin-equivalent permission.

Derived attack edges (3)

fromtotechniquedetail
user/dev-alicerole/EC2-Adminaws-passrole-runinstancesRun an EC2 instance with role role/EC2-Admin attached, then read IMDS.
user/dev-alicerole/Read-Onlyaws-passrole-runinstancesRun an EC2 instance with role role/Read-Only attached, then read IMDS.
role/EC2-Adminadminimplicit-adminrole/EC2-Admin already holds an admin-equivalent permission.