pacu

by RhinoSecurityLabs

5.0Kstars

768forks

110watchers

Updated 3 months ago

About

Pacu is an open-source AWS exploitation framework designed for offensive security testing and exploiting configuration flaws within AWS environments.

The AWS exploitation framework, designed for testing the security of Amazon Web Services environments.

Primary Use Case

Pacu is primarily used by penetration testers and security professionals to identify and exploit security weaknesses in Amazon Web Services accounts. It enables users to perform privilege escalation, backdoor IAM users, and attack vulnerable AWS resources, helping organizations assess and improve their cloud security posture.

Key Features

Modular framework allowing easy expansion of functionality
Exploitation of AWS IAM privilege escalation and backdooring
Attacks on vulnerable AWS Lambda functions
Session management for storing AWS credentials and data
Supports running modules across multiple AWS regions
Lightweight and requires only Python 3.7+ and pip3
Docker image available for easy deployment
Active community support via Discord and Stack Overflow

Installation

pip3 install -U pip
pip3 install -U pacu
Run pacu by executing the command: pacu
Alternatively, install with pipx using: pipx install git+https://github.com/RhinoSecurityLabs/pacu.git
For Docker, run: docker run -it rhinosecuritylabs/pacu:latest
To run Docker without default entrypoint: docker run -it --entrypoint /bin/sh rhinosecuritylabs/pacu:latest
To run Docker with AWS config and credentials mounted: docker run -it -v ~/.aws:/root/.aws rhinosecuritylabs/pacu:latest

Usage

>_ pacu --help

Displays the help menu for Pacu CLI.

>_ pacu --session <session name>

Sets the session to use for commands that require one.

>_ set_keys

Prompts to input AWS access key ID, secret access key, and optional session token to set AWS credentials for the session.

>_ list

Lists available modules for the AWS regions set in the current session.

>_ help module_name

Displays help information for the specified module.

>_ run module_name

Runs the specified module with default parameters.

>_ run module_name --regions eu-west-1,us-west-1

Runs the specified module against the specified AWS regions.

>_ docker run -it rhinosecuritylabs/pacu:latest

Runs the Pacu Docker container with the default entrypoint to start Pacu.

Security Frameworks

Initial Access

Privilege Escalation

Persistence

Defense Evasion

Discovery

Usage Insights

Integrate Pacu into red team toolkits for realistic AWS attack simulations.
Use Pacu modules to validate effectiveness of cloud security controls and IAM policies.
Leverage session management to maintain persistent testing environments across engagements.
Combine Pacu with cloud SIEM tools to improve detection of AWS exploitation attempts.
Employ Pacu in purple team exercises to bridge gaps between offensive and defensive cloud security teams.