Hands-On AWS Penetration Testing with Kali Linux

EC2 exploitation

We have already begun working on some EC2-related stuff, so that's where we are going to start. EC2 is also one of the most common services you will encounter during your pentests, so it is a good idea to become intimately familiar with it and with testing it. EC2 can yield some high impact findings when misconfigured as well, so you can't go wrong by starting with it as your primary service.

The first thing we could check out is what, if any, EC2 instances have public IP addresses. This is simple in the AWS web console, as you can simply sort the results by instances with public IPs. If we wanted to gain console access from our CompromisedUser, we could use the IAM CreateLoginProfile API to create a password for us to login ...