Update iam__bruteforce_permissions to check all AWS services

RhinoSecurityLabs / pacu

The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.

https://rhinosecuritylabs.com/aws/pacu-open-source-aws-exploitation-framework/

BSD 3-Clause "New" or "Revised" License

4.3k stars 689 forks source link

Update iam__bruteforce_permissions to check all AWS services #442

Closed TeneBrae93 closed 3 months ago

TeneBrae93 commented 3 months ago

The current iam__bruteforce_permissions module only checks permissions related to EC2, Log, and S3 which decreases it's usefulness significantly.

This update uses the enumerate-iam library/tool by Andres Riancho to check all applicable services. It still keeps the same functionality of the old module by updating the permissions in the user's session so it can be used by other modules (such as privesc__scan).