Investigating Privesc Methods in AWS

In 2018, Spencer Gietzen wrote an excellent article on privilege escalation in AWS, identifying 21 separate methods across various AWS services. Pen testers often use Spencer’s article on engagements to try and find privilege escalation paths in client environments. Some of the escalation techniques identified by Spencer require in-depth knowledge of specific services, or are part of a multi-step process. But, what are the prerequisites and limitations? What does the escalation path actually look like in practice?

To answer these questions, Gerben Kleijn, a senior security consultant at Bishop Fox, took it upon himself to test Spencer’s methods. He created the exploit scenarios for each of the 21 techniques in his own AWS environment and verified that that one can escalate privileges with all of them. These exercises can be very helpful to fully understand the vulnerabilities introduced by certain AWS permissions. Gerben also sorted these 21 methods into five larger categories and developed a cheat sheet to help remember the overall privesc threats to AWS.

Well, That Escalated Quickly

An in-depth walkthrough of the exploit scenarios for each of the 21 techniques for escalating privileges in an AWS environment.

Read the Blog ›

Escalator to the Cloud: 5 Privesc Attack Vectors in AWS

In reviewing the 21 methods across various AWS services that could lead to privilege escalation, Gerben Kleijn found that the techniques can be sorted into five rough categories. This article discusses those categories at a high level, and what to look out for in each category if you’re the one setting up user permissions.

Read the Blog ›