E-PAC
Pacu
AWS exploitation framework for post-compromise enumeration and privilege-escalation testing within an account.
OVERVIEW
Pacu (github.com/RhinoSecurityLabs/pacu), from Rhino Security Labs, is a modular, open-source AWS exploitation framework built for post-compromise work: once a tester has some initial set of credentials — a leaked access key, an assumed role, an SSRF-obtained instance profile — Pacu's `iam__enum_permissions`, `iam__privesc_scan`, and dozens of other modules systematically map out exactly what that identity can do and which of Rhino's cataloged AWS privilege-escalation paths apply.
It's built around the same session/module structure as Metasploit: modules are organized by service (IAM, S3, EC2, Lambda, and more) and by phase (recon, enum, exploit, persistence), and each one is run and reviewed individually rather than fired off in bulk, which keeps its footprint against a live account deliberate and auditable.
USE CASES
Practical use cases
- 01
Enumerating exactly which IAM actions a given set of credentials can call, including ones denied by explicit policy.
- 02
Running `iam__privesc_scan` to check a compromised identity against known AWS privilege-escalation paths.
- 03
Enumerating and dumping accessible data across S3, EC2, Lambda, and other services from a foothold.
- 04
Testing and demonstrating a specific privilege-escalation chain end to end for the report, module by agreed module.
QUICK START
Once initial AWS credentials are obtained, to systematically enumerate permissions and test known privilege-escalation paths module by module.
- Confirm with the client exactly which AWS account, credentials, and Pacu modules (enumeration vs. exploitation) are in scope.
- Install Pacu and start a new named session (`pacu` then `new_session`), then import the agreed starting credentials.
- Run `run iam__enum_permissions` first to establish what the current identity can actually do.
- Run `run iam__privesc_scan` and review candidate paths before running any exploitation module, confirming each against the rules of engagement.
pacu > run iam__privesc_scanBEFORE YOU RUN IT
What to check before running it
Treat exploitation and persistence modules as separate, explicitly authorized steps — scope Pacu module by module against the rules of engagement rather than running broad scans that touch privilege escalation or persistence by default.
Every API call Pacu makes is recorded in CloudTrail under the credentials used, same as manual AWS CLI activity — agree on expected activity and volume beforehand.
Some modules create real resources (IAM users/keys, Lambda functions, EC2 instances) as part of exploitation or persistence — track and clean up everything Pacu creates before closing the engagement.