pacu icon indicating copy to clipboard operation
pacu copied to clipboard

cfn__resource_injection: Wrongly checking session id of victim as current session

Open jyenduri-uptycs opened this issue 2 years ago • 1 comments

Currently for the module cfn__resource_injection takes two input

  1. s3-access-key : Victims key
  2. attacker-key: Attackers key

In the code we are checking if current session is victims key or not and throwing an error. Victims key and Attacker key cannot have same pacu session at same time, we should just check if victims key exists in pacu database and use that as needed. Function get_aws_key_by_alias_from_db checks if give key alias exists in db or not.

Pacu (attack:attack) > run cfn__resource_injection --attacker-key attack --s3-access-key victim 

jyenduri-uptycs avatar Jun 06 '22 02:06 jyenduri-uptycs

@RyanJarv Please review

jyenduri-uptycs avatar Jun 06 '22 02:06 jyenduri-uptycs