Hands-On AWS Penetration Testing with Kali Linux

Automating it with Pacu

Just like the previous section on backdooring users, this can all be easily automated! In addition to that, it already has been automated for you, with the iam__backdoor_assume_role Pacu module. This module accepts three different arguments, but we are only going to use two of them. The --role-names parameter accepts a list of IAM roles to backdoor in our target account and the --user-arns parameter takes a list of ARNs with which to add a trust relationship for each targeted role. If we were to replicate the scenario we just walked through, that means we would run the following Pacu command:

run iam__backdoor_assume_role --role-names Admin --user-arns arn:aws:iam::012345678912:root 

Pacu will automatically backdoor ...