Amazon Web Services IAM credential enumeration - Metasploit
This page contains detailed information about how to use the auxiliary/cloud/aws/enum_iam metasploit module. For list of all metasploit modules, visit the Metasploit Module Library.
Module Overview
Name: Amazon Web Services IAM credential enumeration
Module: auxiliary/cloud/aws/enum_iam
Source code: modules/auxiliary/cloud/aws/enum_iam.rb
Disclosure date: -
Last modification time: 2021-05-27 15:15:31 +0000
Supported architecture(s): -
Supported platform(s): -
Target service / protocol: -
Target network port(s): -
List of CVEs: -
Provided AWS credentials, this module will call the authenticated API of Amazon Web Services to list all IAM credentials associated with the account
Module Ranking and Traits
Module Ranking:
- normal: The exploit is otherwise reliable, but depends on a specific version and can't (or doesn't) reliably autodetect. More information about ranking can be found here.
Basic Usage
msf > use auxiliary/cloud/aws/enum_iam
msf auxiliary(enum_iam) > show targets
... a list of targets ...
msf auxiliary(enum_iam) > set TARGET target-id
msf auxiliary(enum_iam) > show options
... show and set options ...
msf auxiliary(enum_iam) > exploit
Knowledge Base
Vulnerable Application
Amazon Web Services (AWS) resources can be managed through an API that authenticates based on an ACCESS_KEY_ID and a SECRET_ACCESS_KEY. With these two pieces of information, an attacker can gain privileges which may include enumerating resources within the AWS account.
This module authenticates to AWS IAM (Identify Access Module) to identify user accounts that the credentials can see. The users themselves are likely protected with different credentials, including passwords or MFA tokens. In any case, knowledge of the users is the first step in evaluating their security.
Verification Steps
Create or acquire the credentials
- (If necessary) Create an AWS account. Free trials are available.
- Login to the [AWS Console](https:\console.aws.amazon.com).
- Use the dropbown menu in the top-right with your username, then click on "My Security Credentials".
- Expand the "Access Keys" pane and click "Create New Access Key".
- Follow the steps in the AWS console, making sure to record both the 'access key ID' and 'secret access key'. (The 'secret access key' is only shown once, then can never be retrieved.)
Enumerate AWS resources using the credentials
- Start msfconsole
use auxiliary/cloud/aws/enum_iam- Set the
ACCESS_KEY_IDandSECRET_ACCESS_KEYoptions. run
Options
ACCESS_KEY_ID
This AWS credential is like a username. It uniquely identifies the user, and is paired with a 'secret access key'. The access key ID is retrievable through the AWS console.
An example ACCESS_KEY_ID would be AKIA5C76TR3KXHXA5CRC
SECRET_ACCESS_KEY
This AWS credential is like a password, and should be treated as such. It is paired with a 'access key ID'. The access key ID cannot be retrieved from AWS after it has been generated, but it may be discoverable through environment variables, configuration files, source code, or backups.
An example SECRET_ACCESS_KEY would be EKfx3wOWWiGk1WgBTAZfF\2dq3SbDsQj4jdyOMOv.
REGION
AWS resources are located in regions. Optionally, this module's output can be filtered based on region to minimize the query to AWS. Alternatively, REGION can be left blank, such that all regions will be checked.
An example region would be us-west-2.
LIMIT
Some AWS API calls support limiting output, such that the module will only reutrn the number of instances, without detailing the configuration of each instance. Optionally, this module's output can be filtered to minimize the query to AWS and the user output. Alternatively, LIMIT can be left blank, such that all EC2 instances will be detailed.
Note that the LIMIT parameter is imposed per region, so the total number of results may be higher than the user-specified limit, but the maximum number of results for a single region will not exceed LIMIT. This behavior is due to the AWS API.
An example LIMIT would be 10.
Scenarios
Provided a valid 'access key ID' and 'secret access key' with sufficient privileges
msf5 auxiliary(cloud/aws/enum_ec2) > run
[*] Found 0 instances in eu-north-1
[*] Found 0 instances in ap-south-1
[*] Found 0 instances in eu-west-3
[*] Found 0 instances in eu-west-2
[*] Found 0 instances in eu-west-1
[*] Found 0 instances in ap-northeast-2
[*] Found 0 instances in ap-northeast-1
[*] Found 0 instances in sa-east-1
[*] Found 0 instances in ca-central-1
[*] Found 0 instances in ap-southeast-1
[*] Found 0 instances in ap-southeast-2
[*] Found 0 instances in eu-central-1
[*] Found 0 instances in us-east-1
[*] Found 0 instances in us-east-2
[*] Found 0 instances in us-west-1
[*] Found 1 instances in us-west-2
[+] i-0f8bb3bbb06faf58d (running)
[+] Creation Date: 2019-06-11 23:14:48 UTC
[+] Public IP: 18.236.87.255 (ec2-18-236-87-255.us-west-2.compute.amazonaws.com)
[+] Private IP: 18.236.87.255 (ip-172-31-30-21.us-west-2.compute.internal)
[+] Security Group: sg-0d52cc35aaf82aff5
[*] Auxiliary module execution completed
msf5 auxiliary(cloud/aws/enum_ec2) >
Provided an invalid or inactive 'access key ID', or an invalid 'secret access key'
msf5 auxiliary(cloud\aws\enum_ec2) > run
[-] Auxiliary aborted due to failure: unexpected-reply: AWS was not able to validate the provided access credentials
[*] Auxiliary module execution completed
msf5 auxiliary(cloud\aws\enum_ec2) >
Provided an 'access key ID' or 'secret access key' with insufficient privileges
msf5 auxiliary(cloud\aws\enum_ec2) > run
[-] Auxiliary aborted due to failure: unexpected-reply: You are not authorized to perform this operation.
[*] Auxiliary module execution completed
msf5 auxiliary(cloud\aws\enum_ec2) >
Go back to menu.
Msfconsole Usage
Here is how the cloud/aws/enum_iam auxiliary module looks in the msfconsole:
msf6 > use auxiliary/cloud/aws/enum_iam
msf6 auxiliary(cloud/aws/enum_iam) > show info
Name: Amazon Web Services IAM credential enumeration
Module: auxiliary/cloud/aws/enum_iam
License: Metasploit Framework License (BSD)
Rank: Normal
Provided by:
Aaron Soto <[email protected]>
Check supported:
No
Basic options:
Name Current Setting Required Description
---- --------------- -------- -----------
ACCESS_KEY_ID yes AWS Access Key ID (eg. "AKIAXXXXXXXXXXXXXXXX")
SECRET_ACCESS_KEY yes AWS Secret Access Key (eg. "CA1+XXXXXXXXXXXXXXXXXXXXXX6aYDHHCBuLuV79")
Description:
Provided AWS credentials, this module will call the authenticated
API of Amazon Web Services to list all IAM credentials associated
with the account
Module Options
This is a complete list of options available in the cloud/aws/enum_iam auxiliary module:
msf6 auxiliary(cloud/aws/enum_iam) > show options
Module options (auxiliary/cloud/aws/enum_iam):
Name Current Setting Required Description
---- --------------- -------- -----------
ACCESS_KEY_ID yes AWS Access Key ID (eg. "AKIAXXXXXXXXXXXXXXXX")
SECRET_ACCESS_KEY yes AWS Secret Access Key (eg. "CA1+XXXXXXXXXXXXXXXXXXXXXX6aYDHHCBuLuV79")
Advanced Options
Here is a complete list of advanced options supported by the cloud/aws/enum_iam auxiliary module:
msf6 auxiliary(cloud/aws/enum_iam) > show advanced
Module advanced options (auxiliary/cloud/aws/enum_iam):
Name Current Setting Required Description
---- --------------- -------- -----------
VERBOSE false no Enable detailed status messages
WORKSPACE no Specify the workspace for this module
Auxiliary Actions
This is a list of all auxiliary actions that the cloud/aws/enum_iam module can do:
msf6 auxiliary(cloud/aws/enum_iam) > show actions
Auxiliary actions:
Name Description
---- -----------
Evasion Options
Here is the full list of possible evasion options supported by the cloud/aws/enum_iam auxiliary module in order to evade defenses (e.g. Antivirus, EDR, Firewall, NIDS etc.):
msf6 auxiliary(cloud/aws/enum_iam) > show evasion
Module evasion options:
Name Current Setting Required Description
---- --------------- -------- -----------
Go back to menu.
Error Messages
This module may fail with the following error messages:
Check for the possible causes from the code snippets below found in the module source code. This can often times help in identifying the root cause of the problem.
No users found.
Here is a relevant code snippet related to the "No users found." error message:
107: @users = @iam.list_users.users
108: creds = @iam.get_account_authorization_details
109:
110: users = creds.user_detail_list
111: if users.empty?
112: print_status 'No users found.'
113: return
114: end
115:
116: print_good "Found #{users.count} users."
117: users.each do |i|
Go back to menu.
Related Pull Requests
- #15493 Merged Pull Request: Rails 6.1 upgrade
- #11977 Merged Pull Request: AWS EC2, S3, and IAM Enumeration
Go back to menu.
See Also
Check also the following modules related to this module:
- auxiliary/admin/aws/aws_launch_instances
- auxiliary/cloud/aws/enum_ec2
- auxiliary/cloud/aws/enum_s3
- auxiliary/scanner/http/yaws_traversal
- exploit/unix/webapp/awstats_configdir_exec
- exploit/unix/webapp/awstats_migrate_exec
- exploit/unix/webapp/awstatstotals_multisort
- post/multi/escalate/aws_create_iam_user
- post/multi/gather/aws_ec2_instance_metadata
- post/multi/gather/aws_keys
- auxiliary/scanner/sip/enumerator
- auxiliary/cloud/kubernetes/enum_kubernetes
- auxiliary/gather/enum_dns
- auxiliary/scanner/http/enum_wayback
- exploit/linux/local/diamorphine_rootkit_signal_priv_esc
Authors
- Aaron Soto <[email protected]>
Version
This page has been produced using Metasploit Framework version 6.1.27-dev. For more modules, visit the Metasploit Module Library.
Go back to menu.
