red-shadow - Lightspin AWS IAM Vulnerability Scanner

项目说明


Red-Shadow

Lightspin AWS IAM Scanner

Description

Scan your AWS IAM Configuration for shadow admins in AWS IAM based on misconfigured deny policies not affecting users in groups discovered by Lightspin's Security Research Team.

The tool detects the misconfigurations in the following IAM Objects:

+ Managed Policies

+ Users Inline Policies

+ Groups Inline Policies

+ Roles Inline Policies

Research Summary

AWS IAM e logic for deny policies applied to groups does not work the same way as most security engineers may be used to with other authorization mechanisms.

Suppose a policy with a group resource has an explicit deny. In that case, this will only impact group actions and not user actions, opening organizations up to misconfiguration and if they assume the process to be the same as with Acti, for example.

Example for json policy:

In this example, the policy should deny any iam action done by users, groups, or roles with that policy attached to, towards the group called managers.

The fact is that simple IAM action like would work as the deny policy is ineffective.

Link to the full security research blog

Detection

AWS IAM has a clear seperation between user object actions and group object actions.

The following list includes the user object actions the tool is scanning over deny policies affecting groups (besides wildcard):

Many of the user object actions mentioned above can easily lead to a pri escalation or compromising the account, such as resetting the admin's password, deacti the root account MFA, and more.

Requirements

Red-Shadow is built with Python 3 and Boto3.

The tool requires:

IAM User with Access Key in OS Env

Sufficient permissions for the IAM User to run the scanner

Python 3 and pip3 installed

Installation

Usage

Analyze Results

The results discover any IAM object that is to such authorization bypass in AWS.

Example of results output:

In this console output, we can see that our ProtectManagers deny policy is ineffective and to attacks such as pri escalation mentioned above.
#

Simulation & Exploitation

To the IAM and run the exploitation you can run the following flow:

1.
2.
3.
4.
5. create a policy.json file with the contents below (replace the account id):

6.
7.
8.
9.
10.
11. Create a policy to allow the users to create access keys in policy_iam.json file for the backend-de:

12.
13.
14. our configuration using:

15.
16. Configure the new access key and secret in aws profile (locan env)
17. Now the user BobAttacker can create access key for all resources but has an explicit deny for the managers group.

Lets Exploit the using:

Pri Escalation Complete!

#

Remediation

Once you ha the policies to the authorization bypass, there are two possible ways to remediate the and fix the policy:

OPTION 1: Define all relevant users in the resource field instead of groups to avoid ineffective iam actions, and deny all group actions, such as the following example:

OPTION 2: Use condition in the policy with iam:ResourceTag in place such as the following example:

Contact Us

This research was held by Lightspin's Security Research Team.
For more information, contact us at .

License

This repository is a under the Apache License 2.0.

项目信息

开发语言：Python

Star 数：95

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Lightspin AWS IAM Vulnerability Scanner展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。