Hacking AWS Services | iam_privesc_by_attachment (Medium / Moderate)

CloudGoat (☁️🐐)
CloudGoat is Rhino Security Labs' "Vulnerable by Design" AWS deployment tool.
=-=-=-=-=-==-=-==-=-==-=-==-=-==-=-==-=-==-=-=
Note: This is for educational purposes only!
=-=-=-=-=-==-=-==-=-==-=-==-=-==-=-==-=-==-=-=
Starting with a very limited set of permissions, the attacker is able to leverage the instance-profile-attachment permissions to create a new EC2 instance with significantly greater privileges than their own. With access to this new EC2 instance, the attacker gains full administrative powers within the target account and is able to accomplish the scenario's goal - deleting the cg-super-critical-security-server and paving the way for further nefarious actions.
Note: This scenario may require you to create some AWS resources, and because CloudGoat can only manage resources it creates, you should remove them manually before running ./cloudgoat destroy.

[@ropz8677]

Happy holidays brother, my best wishes to you and your channel!