Exploit for cloud-misconfig-lab

## https://sploitus.com/exploit?id=6421561B-13D2-58C9-ABB5-00C705F9E79B
# Cloud Misconfiguration Exploitation Lab

[![AWS](https://img.shields.io/badge/AWS-Primary-orange)](aws-lab/)
[![Azure](https://img.shields.io/badge/Azure-Bonus-blue)](azure-lab/)
[![Terraform](https://img.shields.io/badge/Terraform-IaC-purple)](https://terraform.io)
[![Python](https://img.shields.io/badge/Python-3.11+-green)](https://python.org)

> **⚠️ EDUCATIONAL PURPOSE ONLY**: This lab creates intentionally vulnerable cloud resources for security training. **DO NOT deploy in production environments.**

## Overview

A fully reproducible cloud security lab demonstrating **privilege escalation chains** from common misconfigurations. Built on the Pacu/ScoutSuite methodology, scoped to a specific attack chain: **"from an over-permissioned Lambda with `iam:PassRole` to full account takeover."**

## Attack Chain

```
┌─────────────────┐     ┌──────────────────┐     ┌─────────────────┐     ┌─────────────────┐
│  Reconnaissance │────▶│ iam:PassRole     │────▶│ Admin Lambda    │────▶│ Account         │
│  (Enumerate     │     │ Exploitation     │     │ Creation        │     │ Takeover        │
│   vulnerable    │     │ (Pass admin role │     │ (Backdoor with  │     │ (Persistent     │
│   Lambda roles) │     │  to new Lambda)  │     │  admin creds)   │     │  admin access)  │
└─────────────────┘     └──────────────────┘     └─────────────────┘     └─────────────────┘
```

## Quick Start

### Prerequisites
- AWS CLI configured with credentials
- Terraform >= 1.5
- Python >= 3.11
- Azure CLI (for bonus module)

### AWS Lab Deployment

```bash
# 1. Clone and enter AWS lab
cd aws-lab

# 2. Initialize Terraform
terraform init

# 3. Deploy vulnerable infrastructure
terraform apply

# 4. Note the outputs (Lambda URL, role ARNs, etc.)
```

### Running the Attack Chain

```bash
# Install dependencies
cd exploit-scripts
pip install -r requirements.txt

# Phase 1: Reconnaissance
python3 reconnaissance.py --profile your-profile

# Phase 2: Privilege Escalation
python3 privilege_escalation.py --profile your-profile

# Phase 3: Post-Exploitation (use keys from Phase 2)
python3 post_exploitation.py --access-key AKIA... --secret-key ...
```

### Azure Bonus Module

```bash
cd azure-lab
terraform init
terraform apply
python3 exploit.py
```

## Project Structure

```
cloud-misconfig-lab/
├── aws-lab/
│   ├── main.tf              # Vulnerable AWS infrastructure
│   ├── variables.tf
│   ├── terraform.tfvars
│   └── cleanup.sh
├── azure-lab/
│   ├── main.tf              # Vulnerable Azure infrastructure
│   ├── variables.tf
│   ├── terraform.tfvars
│   ├── exploit.py
│   └── cleanup.sh
├── exploit-scripts/
│   ├── reconnaissance.py           # Phase 1: Information gathering
│   ├── privilege_escalation.py     # Phase 2: iam:PassRole exploit
│   ├── post_exploitation.py        # Phase 3: Data exfiltration & persistence
│   ├── pacu_integration.py         # Pacu-style module integration
│   └── requirements.txt
└── docs/
    └── writeup.md             # Detailed attack walkthrough
```

## Vulnerabilities Demonstrated

| Vulnerability | Impact | CWE |
|-------------|--------|-----|
| `iam:PassRole` without service restriction | Privilege escalation | CWE-250 |
| Lambda with wildcard assume role | Lateral movement | CWE-287 |
| Public S3 bucket with sensitive data | Data breach | CWE-276 |
| Overly permissive security groups | Network compromise | CWE-1326 |
| Unauthenticated Lambda function URL | Unauthorized access | CWE-306 |
| Azure Function App as Contributor | Subscription takeover | CWE-250 |
| Public Azure Blob storage | Data exfiltration | CWE-276 |

## Pacu Integration

The `pacu_integration.py` script provides Pacu-compatible output format. To use with Pacu:

```bash
# Install Pacu
pip install pacu

# Run our module in Pacu style
python3 exploit-scripts/pacu_integration.py --module recon
```

## Cleanup

**⚠️ IMPORTANT: Destroy resources after use to avoid charges**

```bash
# AWS cleanup
cd aws-lab && ./cleanup.sh

# Azure cleanup
cd azure-lab && ./cleanup.sh
```

## License

MIT License - For educational and authorized security testing only.