Login Papers Register

Need an account to vote? Register to attend at gsec.hitb.org/sg2017/

<< previous next >>

Cumulus - A Cloud Exploitation Toolkit

Javier Godinez

3 vote(s)

The Cloud enables software projects to speed up development because it allows developers to provision infrastructure and make configuration changes to their networks without much friction. This ease of deployment was but a dream in the age of the traditional datacenter. However, the Cloud also brings new attack surface which needs further exploration. Cloud Identity and Access Management (IAM) services (such as Amazon’s) are somewhat misunderstood by both administrators and security professionals alike, which makes them primary targets for attackers as these typically control access to most valuable resources a company may possess.

Over the years there has been various discussions around cloud security, e.g., Pivoting in Amazon Clouds (2013), and few tools have been developed to enable testing the security of Cloud deployments. These tools are standalone, have not attained wide adoption, and/or have not made it into widely adopted toolkits. To fill this void, we have developed the Cumulus Toolkit. The Cumulus Toolkit is a Cloud exploitation toolkit based on the Metasploit Framework. We chose Metasploit because its wide adoption and its wealth of existing features.

The Cumulus Toolkit is a Cloud exploitation toolkit based on the Metasploit Framework. Although parts of Cumulus are currently under heavy development, some parts such as the Create IAM User (CIAMU) module have already been merged into the Metasploit Framework project, see https://github.com/rapid7/metasploit-framework/pull/7604. Cumulus takes advantage Metasploit’s existing exploitation code and session management features to provide the initial foothold into the Cloud. Cumulus is comprised of three main modules which perform

1). Privilege Escalation,

2). Account Takeover, and

3). Launch Unauthorized Workloads.

About Javier Godinez

Javier Godinez is a Principal Security Engineer, Red Team Founder and Software Developer at Intuit. He has been working in the Cloud security space for the last four years and has developed a number of applications for testing the security of Cloud deployments and patterns for operating in the Cloud securely. He has previously worked for SAIC and SSC San Diego delivering unique security platforms to support cybersecurity. Javier is a Certified Information Systems Security Professional (CISSP) and Certified AWS Solutions Architect.