Offensive Terraform's repositories
offensive-terraform.github.io
Offensive Terraform Website
terraform-aws-ec2-kali-linux
Offensive Terraform module which creates Kali Linux from the AWS marketplace and installs cloud security tools (Pacu, Cloudsplaining, ScoutSuite).
terraform-aws-ec2-instance-reverse-shell
Offensive Terraform module which creates EC2 instance and reverse shell from an EC2 instance to attacker machine.
terraform-aws-ebs-snapshot-publicly-exposed
Offensive Terraform module which copies publicly exposed EBS snapshot to us-east-1 region in attacker's AWS account and creates EBS volume from the copied EBS snapshot. After that, the module attaches and mounts the EBS volume to an EC2 instance. Finally, attacker can ssh into an EC2 instance and inspect a mounted volume "/usr/src/hack".
terraform-aws-cross-account-persistence
Offensive Terraform module which creates an IAM role with trust relationship with attacker's AWS account and attaches managed IAM Policy to an IAM role.
terraform-aws-lambda-function-credential-exfiltration
Offensive Terraform module which creates Lambda function with existing IAM role. The module invokes it automatically to exfiltrate AWS temporary credential from environment variables and send it back with response.
terraform-aws-rds-snapshot-publicly-exposed
Offensive Terraform module which creates RDS database from a publicly exposed RDS snapshot in attacker's AWS account. After that, attacker can connect to RDS database and inspect it.
terraform-aws-s3-subdomain-takeover
Offensive Terraform module which takes over a subdomain which has a CNAME record pointing to non-existing S3 bucket in target's Route53. The module creates a S3 bucket with a name as subdomain in the specific AWS region that CNAME record is pointing to. Also, it uploads a simple web page with "404 Page Not Found" text.
terraform-aws-iam-create-user-persistence
Offensive Terraform module which creates IAM user, access key then attaches managed IAM Policy to an IAM user.
terraform-aws-ec2-instance-credential-exfiltration
Offensive Terraform module which creates EC2 instance and exfiltrate credential from Instance metadata to external URL.