Pacu

Pacu, created and maintained by Rhino Security Labs, is an open-source AWS exploitation framework tailored for offensive security testing in cloud environments. It allows penetration testers to identify and exploit configuration flaws within an AWS account through a modular architecture that facilitates easy expansion of capabilities.

Current modules support a variety of attacks, including user privilege escalation, backdooring of IAM users, and targeting vulnerable Lambda functions, among others. This makes Pacu a versatile tool for assessing and demonstrating AWS security weaknesses in controlled testing scenarios.

The framework integrates with standard AWS tools and Python libraries, providing a structured approach to cloud penetration testing. It is particularly useful for red team exercises focused on AWS infrastructure.

Pacu operates as a modular framework leveraging AWS SDKs like boto3 to interact with AWS services. Modules execute specific exploitation techniques, such as privilege escalation via misconfigurations or IAM backdooring, by manipulating AWS APIs, policies, and resources. Sessions manage credentials and state, enabling persistent testing across regions and services.