RedCloud OS: A Comprehensive Overview

Environment Variable Setup

However, the following variables may not cover all possible scenarios, and additional ones may be required depending on the specific case.

AWS

export AWS_ACCESS_KEY_ID=<access_key_id>

export AWS_SECRET_ACCESS_KEY=<access_key>

export AWS_DEFAULT_REGION=<region>

Azure

export AZURE_CLIENT_ID = <app-id>

export AZURE_TENANT_ID = <tenant-id>

export AZURE_CLIENT_SECRET = <app-secret>

GCP

export GOOGLE_APPLICATION_CREDENTIALS = <Service Account Json File Path>

Available Tools

AWS

• AWSCLI

The AWS Command Line Interface (AWS CLI) serves as a comprehensive tool for overseeing your AWS services.

• AWS Consoler

The AWS Management Console is a web application that comprises and refers to a broad collection of service consoles for managing AWS resources.

• AWS Escalate
• CloudCopy

This tool implements a cloud version of the Shadow Copy attack against domain controllers running in AWS.

• CloudJack

CloudJack assesses AWS accounts for subdomain hijacking vulnerabilities because of decoupled Route53 and CloudFront configurations.

• CloudMapper

CloudMapper helps you analyze your Amazon Web Services (AWS) environments.

• CredKing

CredKing can easily launch a password spray using AWS Lambda across multiple regions, rotating IP addresses with each request.

• Endgame

An AWS Pentesting tool that lets you use one-liner commands to backdoor an AWS account’s resources with a rogue AWS account – or share the resources with the entire internet.

• Pacu

Pacu is an open-source AWS exploitation framework, designed for offensive security testing against cloud environments.

• Redboto

Redboto is a collection of scripts that use the Amazon SDK for Python boto3 to perform red team operations against the AWS API.

• weirdAAL

WeirdAAL uses boto3 and it handles standard AWS keypair setups. This means that WeirdAAL will also support STS tokens via the boto3 library.

Azure

• AADCookieSpoof

AADCookieSpoof is a Cookie replay client for testing Azure AD Identity Protection.

• AADInternals

AADInternals is PowerShell module for administering Azure AD and Office 365.

• AZ CLI

The Azure Command-Line Interface (CLI) is a cross-platform command-line tool to connect to Azure and execute administrative commands on Azure resources.

•  AzureAD

Azure Active Directory (Azure AD), now known as Microsoft Entra ID, is Microsoft’s identity and access management solution.

• AzureHound

AzureHound is the BloodHound data collector for Microsoft Azure.

• BloodHound

BloodHound is a single page Javascript web application, built on top of Linkurious, compiled with Electron, with a Neo4j database fed by a C# data collector.

• DCToolbox

DCToolbox PowerShell module contains a collection of tools for Microsoft 365 security tasks, Microsoft Graph functions, Entra ID management, Conditional Access, zero trust strategies, attack, and defence scenarios, etc.

• MFASweep

MFASweep is a PowerShell script that attempts to log in to various Microsoft services using a provided set of credentials and will attempt to identify if MFA is enabled.

• MicroBurst

MicroBurst includes functions and scripts that support Azure Services discovery, weak configuration auditing, and post exploitation actions such as credential dumping.

• Microsoft365 devicePhish

This is a simple proof-of-concept script that allows an attacker to conduct a phishing attack against Microsoft 365 OAuth Authorization Flow.

• MS Graph

The Microsoft Graph PowerShell SDK is made up of a set of modules that enable you to interact with the Microsoft Graph API using PowerShell commands.

• PowerUpSQL

PowerUpSQL includes functions that support SQL Server discovery, weak configuration auditing, privilege escalation on scale, and post exploitation actions such as OS command execution.

• ROADtools

ROADtools is a framework to interact with Azure AD. It consists of a library (roadlib) with common components, the ROADrecon Azure AD exploration tool and the ROADtools Token eXchange (roadtx) tool.

• TeamFiltration

TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts.

• TokenTactics

GCP

• Gcloud CLI

The Google Cloud CLI is a set of tools to create and manage Google Cloud resources. You can use these tools to perform many common platform tasks from the command line or through scripts and other automation.

• GCPBucketBrute

GCPBucketBrute is a script to enumerate Google Storage buckets, determine what access you have to them, and determine if they can be privilege escalated.

• GCP Delegation

Miscellaneous tools related to attack operations in Google Cloud Platform.

• GCP Enum

GCP Enum is a simple bash script to enumerate Google Cloud Platform environments.

• GCP Firewall Enum

This tool analyses the output of several gcloud commands to determine which compute instances have network ports exposed to the public Internet.

• GCP IAM Collector

– GCP IAM Collector is a collection python scripts for collecting and visualising Google Cloud Platform IAM permissions

• GCP IAM Privilege Escalation
• GCPTokenReuse

CPTokenReuse helps pentester / red teamer to configure access token using gcloud cli.

• GoogleWorkspaceDirectoryDump

Script written in Python3 which dumps the user/group from the Google Workspace. This tool can be used to map the group member relationship which can aid further cyber operations.

• Hayat

Google Cloud Platform Auditing & Hardening Script

Multi-Cloud

• Cartography

Cartography is a Python tool that consolidates infrastructure assets and the relationships between them in an intuitive graph view powered by a Neo4j database.

• CCAT

Cloud Container Attack Tool (CCAT) is a tool for testing security of container environments.

• CloudBrute

A tool to find a company’s (target) infrastructure, files, and apps on the top cloud providers (Amazon, Google, Microsoft, DigitalOcean, Alibaba, Vultr, Linode).

• CloudEnum

Multi-cloud OSINT tool. Enumerate public resources in AWS, Azure, and Google Cloud.

• Cloud Service Enum
• Evilginx2

Evilginx is a man-in-the-middle attack framework used for phishing login credentials along with session cookies, which in turn allows bypassing 2-factor authentication protection.

• Gitleaks

Gitleaks is a SAST tool for detecting and preventing hardcoded secrets like passwords, api keys, and tokens in git repos.

• Impacket

Impacket is a collection of Python classes for working with network protocols.

• Leonidas

This is the repository containing Leonidas, a framework for executing attacker actions in the cloud.

• Modlishka

Modlishka is a powerful and flexible HTTP reverse proxy. It implements an entirely new and interesting approach of handling browser-based HTTP traffic flow, which allows it to transparently proxy multi-domain destination traffic, both TLS and non-TLS, over a single domain, without a requirement of installing any additional certificate on the client.

• MOSE

MOSE is a post exploitation tool that enables security professionals with little or no experience with configuration management (CM) technologies to leverage them to compromise environments.

• PurplePanda

This tool fetches resources from different cloud/SaaS applications focusing on permissions to identify privilege escalation paths and dangerous permissions in the cloud/SaaS configurations.

• Responder

Responder is an LLMNR, NBT-NS and MDNS poisoner.

• ScoutSuite

Scout Suite is an open-source multi cloud security-auditing tool, which enables security posture assessment of cloud environments.

• SkyArk

SkyArk is a cloud security project with two main scanning modules:

AzureStealth – Scans Azure environments

AWStealth – Scan AWS environments

These two scanning modules will discover the most privileged entities in the target AWS and Azure.

• Zphisher

My Views

As an avid user of Redcloud OS, I’ve found it to be a remarkably accessible and intuitive operating system tailored specifically for adversary simulation tasks within cloud environments. From the moment you download it, the simplicity of installation and configuration becomes evident, making it an ideal choice for both beginners and seasoned professionals alike.

One of the standout features of CWL’s Redcloud OS is its integration with major cloud platforms such as Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP). This integration provides users with a suite of tools optimised for conducting adversary simulations within these environments. Whether you’re testing the security of your own cloud infrastructure or simulating real-world attack scenarios, Redcloud OS offers the necessary tools right out of the box.

What truly sets Redcloud OS apart is its user-friendly interface and accessible options. Unlike some other cybersecurity-focused operating systems that can feel overwhelming or require extensive customization, Redcloud OS streamlines the process, allowing users to focus on their objectives rather than grappling with complex configurations. Every tool and options are conveniently placed and easily accessible, making it a breeze to navigate even for those new to adversary simulation.

In conclusion, my experience with RedCloud OS : Cloud Adversary Simulation Operating System has been nothing short of exceptional. Its ease of use, coupled with its comprehensive feature set, makes it an indispensable asset for anyone involved in adversary simulation within cloud environments.

Learning Material

• Multi-Cloud Red Team Analyst [MCRTA]
• Hybrid Multi-Cloud Red Team Specialist [CHMRTS]
• Google Cloud Red Team Specialist [CGRTS]
• AWS Cloud Red Team Specialist [CARTS]