About

This tool is a wrapper around Pacu, an open source AWS exploitation framework designed to test the security of AWS environments. More info about Pacu here: https://github.com/RhinoSecurityLabs/pacu

At the time of this tool's implementation, Pacu didn't have a suitable way to bulk import AWS secrets into it and run modules against all of them. This tool aims to solve that use-case. It uses Go's concurrency features to quickly interate over the provided secrets and run Pacu modules against them, generating a result file at the end of the test.

Limitations

1. Only works on Linux. This is due to a limitation in the Expect framework for Golang. Ref: google/goexpect#13

2. This tool has currently been tested to work for the below Pacu modules.

   • enum__secrets
   • lambda__enum
   • ec2__enum
   • [WIP]...

   At the time of testing, these modules invoked consistent behavior such that they could be automated. Other modules may/may not work with this tool, as each of those modules invoke a different behavior specific to that module.

Pre-requisites

1. Install Pacu from here: https://github.com/RhinoSecurityLabs/pacu (Its recommended to run Pacu within a Python virtual environment)
2. Install Golang from here: https://go.dev/doc/install

How to run this tool

go run main.go

Usage of /tmp/go-build1680096689/b001/exe/main:
  -parallel int
        Number of parallel threads to execute (default 10)
  -resultFile string
        Path to store the results file (csv format)
  -secrets string
        Path to AWS secrets file. eg: aws.json
exit status 1

1. Start up your Python virtual environment (make sure Pacu is already installed to this virtual environment): python3 -m venv env

2. Build this tool go build github.com/vas0k/bsp

3. Run it: go run main.go --secrets <path to AWS secrets.json> --resultFile <path to store results>. (OR) ./bsp --secrets <path to AWS secrets.json> --resultFile <path to store results>.

The script currently handles JSON in the following format:

"AWS_keys": {
    "key_value": [
      {
          "client_id": "<aws_access_key_id-1>",
          "client_secret": "<aws_secret_access_key-1>"
     },
     {
          "client_id": "<aws_access_key_id-2>",
          "client_secret": "<aws_secret_access_key-2>"
     }
     ...
    ]
}

Results file:

<access_key_id>,lambda__enum,] MODULE SUMMARY:  Nothing was enumeratedPacu (Pacu:test_AWS_Key_2) >
<access_key_id>,lambda__enum,] MODULE SUMMARY:  Nothing was enumeratedPacu (Pacu:test_AWS_Key_2) >
<access_key_id>,lambda__enum,] MODULE SUMMARY:  Nothing was enumeratedPacu (Pacu:test_AWS_Key_2) >