Description

IAMActionHunter is an IAM policy statement parser and query tool aims to simplify the process of collecting and understanding permission policy statements for users and roles in AWS Identity and Access Management (IAM). Although its functionality is straightforward, this tool was developed in response to the need for an efficient solution during day-to-day AWS penetration testing.

Blog Post

https://rhinosecuritylabs.com/aws/iamactionhunter-aws-iam-permissions/

Offensive Use

The tool can be utilized to search for potential privilege escalation opportunities in AWS accounts by querying various AWS IAM actions that might be exploited. While other tools perform scans to identify privilege escalation risks, this tool enables a more manual approach, allowing users to investigate permissions and quickly review the roles, users, and resources they apply to for targeted analysis.

Blue Team Use

This tool also offers the ability to output and save query results in a CSV format, which is beneficial for security teams seeking a high-level overview of principal permissions and resources within an AWS account. For instance, you may want to identify users and roles with iam:put* permissions in an account. By executing a query and generating a CSV, you can easily review all users and roles with these permissions, along with the resources they have access to.

Installation

Suggested: pip3 install iamactionhunter

Much of this functionality has also been implemented into https://github.com/RhinoSecurityLabs/pacu as a module, iam__enum_action_query if you prefer that.

Clone and use Poetry: ``` git clone https://github.com/RhinoSecurityLabs/IAMActionHunter.git cd IAMActionHunter

(potentially necessary: poetry env use python3.9)

poetry install iamactionhunter --help iamactionhunter --collect --profile ```

Clone and use Pip: git clone https://github.com/RhinoSecurityLabs/IAMActionHunter.git cd IAMActionHunter pip install . iamactionhunter --help iamactionhunter --collect --profile <some-aws-profile>

Usage

Help: ``` usage: iamactionhunter [-h] [--profile PROFILE] [--account ACCOUNT] [--query QUERY] [--role ROLE] [--user USER] [--all-or-none] [--collect] [--list] [--csv CSV] [--config CONFIG]

Collect all policies for all users/roles in an AWS account and then query the policies for permissions.

optional arguments: -h, --help show this help message and exit --profile PROFILE The name of the AWS profile to use for authentication for user/role collection. --account ACCOUNT Account number to query. --query QUERY Permissions to query. A string like: s3:GetObject or s3:* or s3:GetObject,s3:PutObject --role ROLE Filter role to query. --user USER Filter user to query. --all-or-none Check if all queried actions are allowed, not just some. --collect Collect user and role policies for the account. --list List accounts available to query. --csv CSV File name for CSV report output. --config CONFIG JSON config file for preset queries. ```

Examples

First download all IAM info for users and roles:
iamactionhunter --collect --profile my-aws-profile

List any account data has been collected for:
iamactionhunter --list

Then query something:
iamactionhunter --account <account_number_of_profile_above> --query iam:create*

Then query more:
iamactionhunter --account <account_number_of_profile_above> --query iam:create*,iam:put*

Query a particular role:
iamactionhunter --account <account_number_of_profile_above> --role some_role --query iam:*

Query a particular user:
iamactionhunter --account <account_number_of_profile_above> --user some_user --query iam:*

Output to a CSV:
iamactionhunter --account <account_number_of_profile_above> --query iam:* --csv report.csv

Run a preset config:
iamactionhunter --account <account_number_of_profile_above> --config dangerous_iam

Run a query which only shows the results if a user or role has all queried permissions:
iamactionhunter --account <account_number_of_profile_above> --query s3:getobject,s3:listbucket --all-or-none

Configs

Builtin config options are: dangerous_iam write_actions privescs iamactionhunter --account <account_number_of_profile> --config dangerous_iam

Creating Custom Configs

A config file is a JSON file that specifies some specific permissions you want to look for. Here is an example file which searches for write actions in CodeBuild. [ { "Description": "These are all actions which may allow some kind of write privilege in CodeBuild.", "Name": "CodeBuildWriteActions", "ActionsNeeded": [ "codebuild:Put*", "codebuild:Create*", "codebuild:Delete*", "codebuild:Modify*", "codebuild:Update*", "codebuild:Attach*", "codebuild:Detach*", "codebuild:Associate*", "codebuild:Disassociate*", "codebuild:Add*", "codebuild:Remove*", "codebuild:Set*", "codebuild:Enable*", "codebuild:Disable*", "codebuild:Reset*", "codebuild:Stop*", "codebuild:Terminate*", "codebuild:Reboot*", "codebuild:Start*" ], "AllOrNone": false } ] You could then run the config by simply specifying the file name in the --config argument.
iamactionhunter --account <account_number_of_profile> --config write_code_build.json