Hands-On AWS Penetration Testing with Kali Linux

Authenticated reconnaissance plus permissions enumeration

To begin the authenticated recon portion of our assessment, we will need to use the swap_keys Pacu command to switch from our PersonalUser to the CompromisedUser:

1. Run swap_keys in Pacu to switch to the CompromisedUser.

2. The first thing to do for authenticated recon is to find out our own privileges so that we know what kind of access we have to the AWS account. This can be done by using the iam__enum_permissions Pacu module. It doesn't need any arguments for our current purpose, so we can run the following command:

run iam__enum_permissions

3. Next, we can check out what permissions were enumerated with the whoami command:

Running iam__enum_permissions and checking out what data ...