Leverage Insecure Storage and Backups for Profit

What this lab covers

You enumerate storage and identity permissions, recover a Windows administrator credential from launch material, and extract credential data that opens up access beyond the machine it came from.

The lab illustrates why backups deserve the same classification as the systems they copy. Organizations routinely apply careful controls to a domain controller and store its backup in a bucket with a policy nobody has read in two years.

It assumes no prior AWS experience and spans cloud storage and Windows credential material, which reflects how hybrid environments actually fail.

How exposed backups lead to broad compromise

Backups and machine images are created by automation on a schedule and outlive the systems and the people that produced them. They accumulate in storage, they are rarely inventoried, and their access controls are frequently set once at creation.

What makes them valuable is completeness. A backup contains the filesystem, the configuration, the certificates and the credential stores, so recovering one is equivalent to obtaining the host without touching the running system or triggering anything that monitors it.

In Windows environments the credential material is the prize. Backups of domain-joined systems contain hashes and secrets that permit authentication elsewhere, which is how a storage misconfiguration becomes a directory compromise. The launch credential for a cloud instance is a related shortcut, providing administrator access to the instance itself.

How to detect this in your own environment

Enable data events on buckets holding backups and alert on reads. Backup storage has an extremely predictable access pattern, so any read by an identity outside the backup system is worth investigating immediately.

Alert on bucket policy changes for backup locations, and on backups being copied to accounts or regions outside your inventory.

Watch for authentication using credentials that should only exist inside a backup, since the use of recovered credential material is the stage that produces downstream impact.

How to prevent it

Classify backups as equal in sensitivity to their source systems and apply matching controls. This single reclassification drives everything else and is usually the missing decision.

Encrypt backups with keys held separately, so obtaining the file is not the same as obtaining the contents, and restrict who can read both the object and the key.

Keep backups in a separate account with independent access control, which serves both this threat and ransomware, and inventory them so old copies of decommissioned systems do not linger indefinitely.

Real-world context

Exposed backups are a recurring source of significant breaches across both cloud and on-premises environments, and they are attractive precisely because they are complete, unmonitored and often forgotten.

The hybrid dimension raises the impact. A backup of a domain-joined Windows system found in cloud storage can lead to on-premises directory compromise, which means a storage permission becomes an enterprise-wide incident.

The pattern maps to MITRE ATT&CK T1530 Data from Cloud Storage Object, T1003 OS Credential Dumping and T1078 Valid Accounts.

Applying this at work

• Inventory where your backups and machine images live, including copies in regions and accounts you no longer actively use.
• Apply the same access classification to backups as to the systems they copy.
• Encrypt backups with keys under separate access control from the storage itself.
• Enable data events on backup buckets and alert on any read outside the backup system.
• Delete backups of decommissioned systems rather than letting them accumulate indefinitely.

Frequently asked questions

Why are backups such high-value targets?

Because they are complete copies of systems without the runtime protections of the original. They contain configuration, certificates and credential stores, and accessing one avoids everything that monitors the live host.

What can an attacker do with a Windows system backup?

Recover credential material that permits authentication elsewhere in the environment. In a domain-joined estate, that can turn a storage misconfiguration into a directory-wide compromise.

How should backups be protected?

Classify them as equal in sensitivity to their source systems, encrypt them with separately controlled keys, store them in an account with independent access control, and inventory them so old copies are removed.

Do I need my own AWS account to practice this?

No. The lab runs in a live AWS environment that Pwned Labs provisions for you, so there is nothing to set up and no risk to your own infrastructure.

Which certification covers this in depth?

The Amazon Cloud Red Team Professional (ACRTP) covers AWS attack and detection paths in full, including IAM abuse and privilege escalation, and is assessed hands-on in a live AWS account.