Question

During an authorized cloud penetration test, you gain command execution on an EC2 instance through a vulnerable web application. To escalate access, you want to enumerate the temporary IAM credentials associated with the instance's role. Which action should you take to retrieve those credentials from within the instance?

Accepted Answer

Query the instance metadata service at http://169.254.169.254/latest/meta-data/iam/security-credentials/ to retrieve the role name and associated temporary credentials

Answer

Run an Nmap SYN scan against 169.254.169.254 to enumerate open ports exposing the credential store

Answer

Query the public AWS STS endpoint at https://sts.amazonaws.com without authentication to list the instance's assumed roles

Answer

Read the /etc/aws/credentials file, where EC2 automatically writes the instance profile's access keys on boot