Redboto - Red Team Scripts for AWS.

项目说明

Redboto
==========

`Redboto` is a collection of scripts that use the Amazon SDK for Python boto3
to perform red team operations against the AWS API.

You can install the pre-requisite libraries with:

$ pip install cryptography boto3 texttable

getEC2WinCreds.py
----------

If you have the right API key and .pem you can download and decrypt the intial Windows password for an instance.

getEC2Files.py
----------
Certainly the most complicated script of the bunch. This script works well in conjunction with describeInstances.py which gives you metadata about instances in EC2. With a very well permission API key you can exflitrate files from an EC2 instance. The script takes a snapshot of a target , spins up an instance to attach to the , spins up and creates an S3 bucket, when the instance finishes launching it encrypts and copies the chosen files to the s3 bucket, the script pulls down from the S3 bucket and decrypts the files. The script then tears down the infrastructure that it has created, leaving only logs behind, if enabled.

checkAWSKey.py
----------

Checks certain aspects of a key. when checking if a key has been rotated or not,
or if it has things like MFA have been turned on.

createS3PresignedURL.py
----------
Creates S3 presigned URLs that can be read or written to with GET/POST requests without API keys(once signed). This allows you to download or upload files from or to S3 without an AWS sdk or client.

describeTrailStatus.py
----------

This will tell you what regions ha enabled. If any.

describeInstances.py
----------
You can describe-instances with the AWS cli, however it returns ugly json. This tool returns
a subset(but growing) of what describe-instances does, however it is much more readable.

describeDeletedItems.py
----------
describeDeletedItems.py lists items with delete markers and each of their corresponding . Currently doesn't list all items in a bucket with more than 1000 .

describeUserData.py
----------
describeUserData.py lists the userData attribute of instances. You can think of this as the startup script of the machine.

describeConsoleScreenshot.py
----------
describeConsoleScreenshot.py iterates through instances in each region and prints the screenshots of each instance that is running.

runSSMShellScript.py
----------
runSSMShellScript.py runs a shell script on a Linux host or a PowerShell script on a Windows host via SSM if installed and configured. The commands can be taken from a script or input directly via a semi-interacti.

Pull requests accepted!

项目信息

开发语言：Python

Star 数：167

技术要点

该项目属于红蓝攻防方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Red Team Scripts for AWS.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。