Scribd
Upload
112 views

Assignment 1 - AWS CLOUDGOAT Iam - Privesc - Rollback

1. This document provides instructions for completing a CloudGoat scenario called "iam_privesc_by_rollback" which allows practicing privilege escalation techniques in AWS IAM. 2. It involves deploying CloudGoat in an AWS account, understanding the scenario objective, launching the scenario, examining the initial IAM configuration, performing privilege escalation steps outlined in the scenario, documenting the process, verifying privilege escalation was successful, and analyzing security implications. 3. Key steps include exploiting IAM permissions and configuration changes like rollbacks that can be abused to gain elevated access.

Uploaded by

Kipngeno Moses
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
112 views

Assignment 1 - AWS CLOUDGOAT Iam - Privesc - Rollback

1. This document provides instructions for completing a CloudGoat scenario called "iam_privesc_by_rollback" which allows practicing privilege escalation techniques in AWS IAM. 2. It involves deploying CloudGoat in an AWS account, understanding the scenario objective, launching the scenario, examining the initial IAM configuration, performing privilege escalation steps outlined in the scenario, documenting the process, verifying privilege escalation was successful, and analyzing security implications. 3. Key steps include exploiting IAM permissions and configuration changes like rollbacks that can be abused to gain elevated access.

Uploaded by

Kipngeno Moses
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 2

Assignment: CloudGoat IAM Privilege Escalation by Rollback Scenario

Objective: To understand and practice privilege escalation techniques in AWS IAM (Identity and
Access Management) using the CloudGoat scenario "iam_privesc_by_rollback."
NOTE: You MUST perform this assignment on a KALI LINUX virtual machine.
Instructions:
1. Setup:
• Ensure you have an AWS account or access to an AWS environment where you
can perform IAM actions.
• Install and configure the AWS CLI if you haven't already.
• Video tutorial: https://www.youtube.com/watch?v=vZXpmgAs91s
2. Accessing CloudGoat:
• Navigate to the CloudGoat GitHub repository:
https://github.com/RhinoSecurityLabs/cloudgoat
• Follow the instructions provided to deploy CloudGoat in your AWS environment.
• Video tutorial:
https://www.youtube.com/watch?v=Bdwurohdhq4&list=PLMoaZm9nyKaNRN0
SoR_PBVYc_RAhbZdG4&index=1
3. Understanding the Scenario:
• Read the scenario description and objectives provided in the CloudGoat
documentation to understand the context and goals of the
"iam_privesc_by_rollback" scenario.
• Familiarize yourself with AWS IAM concepts such as users, roles, policies, and
permissions.
4. Starting the Scenario:
• Once CloudGoat is deployed, access the CloudGoat environment using the
provided credentials or IAM user.
• Launch the "iam_privesc_by_rollback" scenario from the CloudGoat menu or
command-line interface.
• Video tutorial:
https://www.youtube.com/watch?v=0aA1UOljLAo&list=PLMoaZm9nyKaNRN0
SoR_PBVYc_RAhbZdG4&index=4
5. Exploring Initial Configuration:
• Use the AWS CLI or AWS Management Console to examine the initial IAM
configuration, including existing users, roles, and policies.
• Identify any permissions assigned to the user or role provided in the scenario.
6. Performing Privilege Escalation:
• Follow the steps outlined in the scenario to exploit IAM permissions and escalate
privileges.
• Pay attention to any rollback mechanisms or configuration changes that can be
abused to gain elevated access.
7. Documenting Steps:
• Document each step you take to escalate privileges, including the commands
executed, policies modified, and permissions obtained.
• Take screenshots or record relevant information to support your findings.
8. Verification:
• Once you believe you've successfully escalated privileges, verify your actions by
accessing restricted resources or performing privileged operations.
9. Reflection and Analysis:
• Reflect on the techniques used to escalate privileges and analyze potential
security implications.
• Consider how such vulnerabilities can be mitigated or prevented in real-world
AWS environments.

You might also like