PwnedLabs Intro to Aws IAM enumeration

aws configure

aws sts get-caller-identity | jq

aws iam get-user | jq

Desafortunadamente no tengo permisos para ver detalles de mi cuenta

aws iam get-account-authorization-details

aws -iam list-users

aws iam list-access-keys

aws iam list-user-policies --user-name dev01

aws iam get-user-policy --user-name dev01 --policy-name S3_Access | jq

Podemos ver que la poliza solo permite dos acciones: s3:ListBucket s3:GetObject

aws iam list-attached-user-policies --user-name dev01

aws iam list-groups-for-user --user-name dev01

aws iam list-policy-versions --policy-arn arn:aws:iam::aws:policy/AmazonGuardDutyReadOnlyAccess

aws iam get-policy-version --policy-arn arn:aws:iam::aws:policy/AmazonGuardDutyReadOnlyAccess --version-id v4

aws iam list-policy-versions --policy-arn arn:aws:iam::794929857501:policy/dev01

aws iam get-policy-version --policy-arn arn:aws:iam::794929857501:policy/dev01 --version-id v7

aws iam list-attached-role-policies --role-name BackendDev | jq

aws iam get-role --role-name BackendDev | jq

aws iam get-policy --policy-arn arn:aws:iam::794929857501:policy/BackendDevPolicy | jq

aws iam get-policy-version --policy-arn arn:aws:iam::794929857501:policy/BackendDevPolicy v1 | jq

aws s3 ls s3://hl-dev-artifacts

aws s3 sync s3://hl-dev-artifacts .

cat flag.txt