CFS275 Ethical Hacking · Chapter 10 · Cloud Audit Tools
Pacu is to Amazon Web Services (AWS) what Metasploit is to a network: a modular framework you drive from a console, loading one module at a time to enumerate, escalate, and persist in a cloud account you have compromised. Just as Metasploit organizes its module tree into auxiliary, exploit, and post, Pacu groups its modules by category (ENUM, ESCALATE, EXFIL, PERSIST, and more), so you browse and search for the one you need the same way.
This terminal is a simulation. It does not connect to AWS, and the keys are fabricated and authenticate nowhere. Pacu is an offensive tool; run it only against accounts you are contracted and authorized to test.
Every module name joins the service to the action with two underscores, not one: iam__enum_permissions, s3__download_bucket, ec2__enum. A single underscore between the service and the action is the most common typo here. Press Tab to let the console complete the name and avoid it.
Load this fabricated key with set_keys when prompted (alias, access key ID, secret, then press Enter to skip the session token):
help
List the Pacu console commands, the same way help works in msfconsole.
set_keys
Load the recovered key into the session. Enter the alias, access key ID, and secret from the box above, then press Enter to skip the session token.
whoami
Show the active key and the principal it belongs to.
ls
List modules grouped by category. This is the Pacu equivalent of browsing the Metasploit module tree.
run iam__enum_permissions
Run the enumeration module to confirm what this key can do. Collected data is stored in the session.
run iam__privesc_scan --scan-only
Scan for privilege escalation paths the confirmed permissions make possible, without exploiting them.
run ec2__enum
Enumerate the compute surface. The module flags a security group that exposes SSH (port 22) to the whole internet.
run s3__download_bucket --bucket-name verdantcart-db-backups
Exfiltrate data. This module takes an argument, the way a Metasploit module takes options. It copies the readable backup objects to the session loot directory.
run iam__backdoor_users_keys
Establish persistence. The module adds a second access key to the user so access survives rotation of the leaked key. This is the same backdoor idea from the credential walkthrough, run from the framework instead of by hand.
data
Show the data collected in this session so far, the way you would review loot and creds in Metasploit.
More to explore on your own: search iam, help iam__privesc_scan, run iam__enum_users_roles_policies_groups, run secretsmanager__enum, services.
Answer these from what the console actually showed you.
simulated · offline
Enter runs a command. Tab autocompletes. Up and down arrows recall history.
Where Pacu attacks, Prowler audits. It runs hundreds of read-only checks against an account and reports misconfigurations as PASS or FAIL, scored by severity and mapped to compliance frameworks. This is the defender's view of the same account.
This terminal is a simulation. Prowler reads configuration using whatever AWS credentials it finds. Here the keys are fabricated and nothing leaves the page.
Prowler does not prompt for keys. It uses the same credential sources as the AWS command line interface: a configured profile or environment variables. Configure the recovered key first, then run the scan.
prowler aws
Run the scan before configuring credentials. Prowler cannot find any and tells you so. This is the first thing to check when a scan fails.
aws configure
Store the recovered key so Prowler can use it. Enter the access key ID, secret, region us-east-2, and output json.
prowler aws
Run the full scan. Read the credentials block, the PASS and FAIL findings by service, the severity summary, and where the reports were written.
prowler aws --services s3
Scope the scan to one service, the way you would focus an audit on the storage findings.
prowler aws --severity critical
Show only the critical findings, the ones a report should lead with.
prowler aws -c s3_bucket_public_access
Run a single named check, the way you re-test one finding after a fix.
More to explore on your own: prowler aws --list-services, prowler aws --list-checks, prowler aws --severity critical high, prowler aws -M csv,html, prowler --version.
Answer these from what the scan actually reported.
simulated · offline
Enter runs a command. Tab autocompletes. Up and down arrows recall history.