Escalate Privileges by IAM Policy Rollback

This beginner-friendly lab demonstrates how the dangerous IAM permission iam:SetDefaultPolicyVersion can be abused to self-escalate privileges in AWS. Starting from leaked credentials, you enumerate an attached IAM policy, discover a more permissive older version, and roll the default back to it to unlock access to an S3 bucket holding sensitive data.

During a review for Huge Logistics your team finds a passwords.xlsx file containing AWS credentials. Using those keys, you enumerate the environment and work to access sensitive data hidden in the company's cloud.

• Basic Linux command line knowledge
• AWS CLI installed and configured
• Provided AWS access keys

• Identify the current identity with aws sts get-caller-identity
• Enumerate attached IAM user policies and list policy versions
• Compare IAM policy version documents to spot excess permissions
• Abuse iam:SetDefaultPolicyVersion to roll back to a more permissive policy version
• Enumerate and download objects from an S3 bucket
• Crack a password protected zip file using zip2john and John the Ripper with the rockyou wordlist

AWS warns that iam:SetDefaultPolicyVersion is a potentially dangerous permission, because an identity holding it can switch the default policy to a dormant version and directly self-escalate its own access.