The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides instructions for executing high-impact commands to manipulate AWS infrastructure and evade detection.
Guidance on using aws cloudtrail delete-trail and update-trail to disable or limit security event logging.
Instructions for executing arbitrary shell commands on EC2 instances using the AWS Systems Manager (SSM) send-command functionality.
Use of sudo mount to attach and access EBS volumes created from snapshots of target instances.
[CREDENTIALS_UNSAFE]: The skill documents several methods for extracting sensitive identity information and temporary security tokens.
Techniques to access the EC2 Instance Metadata Service (IMDSv1 and v2) at 169.254.169.254 to harvest IAM role credentials.
Instructions for reading sensitive environment information from /proc/self/environ to obtain Fargate container credentials.
Enumeration of IAM permissions and the creation of new access keys for target users to maintain access.
Methods for retrieving plain-text secrets from AWS Secrets Manager and decrypting data using KMS.
[DATA_EXFILTRATION]: Detailed workflows are provided for extracting data and proprietary code from the target environment.
Instructions for syncing entire S3 bucket contents to local storage via aws s3 sync.
Procedures for creating EBS snapshots and mounting them to bypass file-system level access controls, including Windows Domain Controller ntds.dit extraction.
Steps to extract Lambda function source code by retrieving download URLs through aws lambda get-function.
[REMOTE_CODE_EXECUTION]: The skill facilitates the injection and execution of code within the cloud environment.
Guidance on downloading Lambda deployment packages via wget using ephemeral URLs provided by the AWS API.
Instructions for backdooring AWS Lambda functions by updating their code with malicious Python handlers that perform privilege escalation.
[EXTERNAL_DOWNLOADS]: The skill references and provides installation steps for various third-party security tools from public repositories.
Fetches tools such as Pacu, cloudmapper, Principal Mapper, and ScoutSuite from well-known security research organizations on GitHub.
Installs supporting Python packages including boto3, prowler, and cloudsplaining from public registries.

aws-penetration-testing