Procedure examples

Once inside a Virtual Private Cloud, Pacu can attempt to identify DirectConnect, VPN, or VPC Peering.

Pacu leverages the AWS CLI for its operations.

Pacu can enumerate IAM permissions.

Pacu leverages valid cloud accounts to perform most of its operations.

Pacu can enumerate IAM users, roles, and groups.

Pacu can generate SSH and API keys for AWS infrastructure and additional API keys for other IAM users.

Pacu can automatically collect data, such as CloudFormation templates, EC2 user data, AWS Inspector reports, and IAM credential reports.

Pacu can enumerate AWS security services, including WAF rules and GuardDuty detectors.

Pacu can enumerate AWS services, such as CloudTrail and CloudWatch.

Pacu can enumerate and download files stored in AWS storage services, such as S3 buckets.

Pacu can set up S3 bucket notifications to trigger a malicious Lambda function when a CloudFormation template is uploaded to the bucket. It can also create Lambda functions that trigger upon the creation of users, roles, and groups.

Pacu can search for sensitive data: for example, in Code Build environment variables, EC2 user data, and Cloud Formation templates.

Pacu can retrieve secrets from the AWS Secrets Manager via the enum_secrets module.

Pacu can create snapshots of EBS volumes and RDS instances.

Pacu can enumerate AWS infrastructure, such as EC2 instances.

Pacu can enumerate AWS storage services, such as S3 buckets and Elastic Block Store volumes.

Pacu can create malicious Lambda functions.

Pacu can run commands on EC2 instances using AWS Systems Manager Run Command.

Pacu can collect CloudTrail event histories and CloudWatch logs.

Pacu can disable or otherwise restrict various AWS logging services, such as AWS CloudTrail and VPC flow logs.

Pacu can allowlist IP addresses in AWS GuardDuty.