Execute and Identify Credential Abuse in AWS

This intermediate lab walks through a full credential abuse attack chain in AWS and then pivots to the blue team to detect it. Starting from a public S3 bucket, you extract leaked IAM credentials, enumerate permissions, exfiltrate DynamoDB records, crack SHA-256 password hashes, and reuse the recovered passwords in a console credential stuffing attack. You then use CloudTrail and Amazon Athena to identify the compromised IAM user.

During a routine audit for Huge Logistics, you discover an unsecured S3 bucket. Your task is to scrutinize its contents, use any sensitive data as pivots, and determine the risk exposure by gaining access to other connected systems.

• Basic Linux command line knowledge
• AWS CLI installed and configured
• Familiarity with Go tooling and hash cracking

• Enumerate a public S3 bucket and exfiltrate a leaked JSON backup with credentials
• Automate IAM permission enumeration using Pacu and aws-enumerator
• Enumerate and scan DynamoDB tables to exfiltrate user records
• Identify and crack SHA-256 hashes with hashid and Jumbo John
• Use a Vim macro to reformat cracked data for a credential stuffing attack
• Run a credential stuffing attack against the AWS console with GoAWSConsoleSpray
• Detect the brute force and identify the compromised IAM user with CloudTrail and Amazon Athena

Password reuse and credential stuffing are prevalent in both on-premise and cloud environments, as users recycle passwords across services. Combined with secrets stored in insecure applications, this creates attack chains that defenders must be able to detect and investigate.