Abusing AWS Organizations Default Configurations for Lateral Movement in Multi-Account Environments
Sesame, salt, and substance. A flagship bake.
Summary
This article explains how AWS Organizations' default multi-account architecture can be abused by penetration testers and red teamers for lateral movement and privilege escalation. It covers the default configuration where the management account has significant control over member accounts, and demonstrates techniques for pivoting between accounts once initial access is gained. The article serves as a security research resource for offensive security professionals.
Key quotes
· 5 pulledAlmost all mid-to-large sized AWS environments make use of multi-account architecture.
Using multiple AWS accounts offers a number of benefits and is considered a best practice.
To help organize and manage those accounts, AWS offers a service called AWS Organizations.
Due to the ubiquity of AWS Organizations, it is important for Penetration Testers and Red Teamers to familiarize themselves with its default configuration.
When an account creates an organization it becomes the management account of that organization.
You might also wanna read
Exploring Leaked AWS Access Keys and Attacker Exploitation: Insights from a Blog Series
The final part of a blog series explores leaked AWS Access Keys, how attackers exploit them, and measures organizations can take to protect
clutch.security·10mo ago
Critical Misconfiguration in Microsoft's Internal Applications Exposes Sensitive Data
The article details a security researcher's discovery of a critical misconfiguration in Microsoft's internal applications, which allowed una
research.eye.security·10mo ago
Critique of sudo's Security Model and the Case for Object Capabilities
The article presents a strong critique of the sudo command in Unix/Linux systems, arguing that it represents fundamental flaws in the modern
ariadne.space·6mo agoAzure API vulnerability and roles misconfiguration compromise corporate networks
Building Scalable Agent Infrastructure: From AWS Lambda to Unikraft Micro-VMs
Browser Use shares their technical journey from running web agents on AWS Lambda to developing a more robust infrastructure using Unikraft m
GitHub Actions workflows identified as common weak link in open source supply chain attacks
This article analyzes a series of high-profile open source supply chain security incidents from the past 18 months, tracing them back to Git