Pacu AWS Exploitation Framework: A Practical Walkthrough

Pacu is an open source Pacu AWS exploitation framework built by Rhino Security Labs for testing the security of Amazon Web Services accounts. It works like Metasploit does for networks: you load credentials, then run modules that enumerate resources, find misconfigurations and test privilege escalation paths. This walkthrough covers the basics and what defenders should know.

Only use Pacu against AWS accounts you own or have written permission to test. Check AWS’s current penetration testing policy before you start.

Install Pacu

On Kali Linux it is packaged, so you can use apt. Elsewhere, install it with pipx to keep it isolated:

# Kali
sudo apt install pacu

# Any system with Python
pipx install pacu

# Start it
pacu

Sessions and keys

Pacu stores everything in a session, so findings carry over between modules and between runs. On first launch it asks you to name a session. Then give it credentials for the account under test, ideally a dedicated test user or the credentials issued for the engagement.

Pacu (lab:No Keys Set) > set_keys
# enter key alias, access key ID, secret access key (and session token if needed)

Pacu (lab:test-user) > whoami
Pacu (lab:test-user) > swap_keys

whoami shows what Pacu knows about the current identity. swap_keys switches between multiple stored sets of keys, which is handy when you are testing what a second role can do.

Find and run modules

Pacu > ls                       # list all modules
Pacu > search iam               # filter by name
Pacu > help iam__enum_permissions   # read a module's options

Modules are grouped by service and named with a double underscore, such as iam__enum_permissions or ec2__enum. Run one with the run command.

A typical first pass

1. Work out what the keys can do. run iam__enum_permissions reads the policies attached to the current identity and records the permissions it holds.
2. Map the account. run iam__enum_users_roles_policies_groups collects users, roles, policies and groups.
3. Look for escalation paths. run iam__privesc_scan checks the identity’s permissions against a list of known privilege escalation methods and can attempt them if you tell it to.
4. Enumerate resources. Modules such as ec2__enum, lambda__enum and s3__download_bucket inspect compute, functions and storage.
5. Review the results. data prints everything collected in the session, and services lists which services have data.

If the identity has no list permissions, iam__bruteforce_permissions tries calls to find out what is allowed. It is noisy, so use it deliberately.

Why privilege escalation matters

Many AWS breaches start with a low-privilege key and end with administrator access. Common routes include permission to attach or create IAM policies, to pass a role to a service that runs your code, or to update the code of a Lambda function that already has a powerful role. Pacu’s scan turns these into a quick checklist, but the findings still need a human to judge the impact.

What defenders should watch for

• CloudTrail: every Pacu call is an API call. Bursts of List*, Get* and Describe* from one identity are a classic enumeration pattern, and so are many AccessDenied errors in a short time.
• GuardDuty: it has finding types for API calls made from well-known pentest distributions, based on the user agent. Attackers can change that string, so treat it as one signal.
• Least privilege: remove permissions like iam:PassRole on * and iam:CreatePolicyVersion from anything that does not need them.
• Short-lived credentials: prefer roles and temporary sessions to long-lived access keys that can sit in a repo for years.

Where Pacu fits

Pacu is not an automatic hacker. It is an organised workbench that saves what you find and chains modules together. Pair it with a configuration scanner such as Prowler or ScoutSuite for broad checks, and use Pacu when you want to prove what a specific set of keys can actually do.