# ThunderCloud | Cloud Exploit Framework

**URL:** <https://onehack.st/t/thundercloud-cloud-exploit-framework/235123>\
**Category:** Tools & Scripts\
**Tags:** tools, hacking, freebies, cloud-storage\
**Created:** [March 28, 2023, 11:33am UTC](https://onehack.st/t/thundercloud-cloud-exploit-framework/235123 "2023-03-28T11:33:38Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [March 28, 2023, 11:33am UTC](https://onehack.st/t/thundercloud-cloud-exploit-framework/235123/1 "2023-03-28T11:33:39Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/a/a/aaed0ef5a9156db881d061ec46a47bfd6c6ac2af.jpeg)

# ThunderCloud

Cloud Exploit Framework

## Usage

```auto
python3 tc.py -h

          ________ ______ _ _
         | ____ | | | | / ____ | | | |
            | | | | ___ _ ___  __| |___ _ __| | | |___ _ _ __| |
            | | | '_ \| | | | '_ \ / _` |/ _ \ '__| | | |/ _ \| | | |/ _` |
            | | | | | | |_| | | | | (_| | __/ | | |____ | | (_) | |_| | (_| |
            \_/ |_| |_|\ __,_|_| |_|\__ ,_|\ ___|_| \_____ |_|\ ___/ \__ ,_|\__,_|

usage: tc.py [-h] [-ce COGNITO_ENDPOINT] [-reg REGION] [-accid AWS_ACCOUNT_ID] [-aws_key AWS_ACCESS_KEY] [-aws_secret AWS_SECRET_KEY] [-bdrole BACKDOOR_ROLE] [-sso SSO_URL] [-enum_roles ENUMERATE_ROLES] [-s3 S3_BUCKET_NAME]
             [-conn_string CONNECTION_STRING] [-blob BLOB] [-shared_access_key SHARED_ACCESS_KEY]

Attack modules of cloud AWS

optional arguments:
  -h, --help show this help message and exit
  -ce COGNITO_ENDPOINT, --cognito_endpoint COGNITO_ENDPOINT
                        to verify if cognito endpoint is vulnerable and to extract credentials
  -reg REGION, --region REGION
                        AWS region of the resource
  -accid AWS_ACCOUNT_ID, --aws_account_id AWS_ACCOUNT_ID
                        AWS account of the victim
  -aws_key AWS_ACCESS_KEY, --aws_access_key AWS_ACCESS_KEY
                        AWS access keys of the victim account
  -aws_secret AWS_SECRET_KEY, --aws_secret_key AWS_SECRET_KEY
                        AWS secret key of the victim account
  -bdrole BACKDOOR_ROLE, --backdoor_role BACKDOOR_ROLE
                        Name of the backdoor role in victim role
  -sso SSO_URL, --sso_url SSO_URL
                        AWS SSO URL to phish for AWS credentials
  -enum_roles ENUMERATE_ROLES, --enumerate_roles ENUMERATE_ROLES
                        To enumerate and assume account roles in victim AWS roles
  -s3 S3_BUCKET_NAME, --s3_bucket_name S3_BUCKET_NAME
                        Execute upload attack on S3 bucket
  -conn_string CONNECTION_STRING, --connection_string CONNECTION_STRING
                        Azure Shared Access key for readingservicebus/queues/blobs etc
  -blob BLOB, --blob BLOB
                        Azure blob enumeration
  -shared_access_key SHARED_ACCESS_KEY, --shared_access_key SHARED_ACCESS_KEY
                        Azure shared key

```

## Requirements

```auto
* python 3
* pip
* git

```

## Installation

```auto
 - get project `git clone https://github.com/Rnalter/ThunderCloud.git && cd ThunderCloud/`   
 - install [virtualenv](https://virtualenv.pypa.io/en/latest/) `pip install virtualenv`
 - create a python 3.6 local enviroment `virtualenv -p python3.6 venv`  
 - activate the virtual enviroment `source venv/bin/activate` 
 - install project dependencies `pip install -r requirements.txt`
 - run the tool via `python tc.py --help`

```

## Running ThunderCloud

Examples

```auto
python3 tc.py -sso <sso_url> --region <region>
python3 tc.py -ce <cognito_endpoint> --region <region>

```

## GitHub:

> **[GitHub - Rnalter/ThunderCloud: Cloud Exploit Framework](https://github.com/Rnalter/ThunderCloud)**
>
> Cloud Exploit Framework

---

<div class="post-metadata">

**Author:** ![VP1401](https://onehack.st/user_avatar/onehack.st/vp1401/32/119320_2.png) [@VP1401](https://onehack.st/u/VP1401)\
**Post date:** [March 28, 2023, 1:43pm UTC](https://onehack.st/t/thundercloud-cloud-exploit-framework/235123/2 "2023-03-28T13:43:56Z")

</div>

This is really cool actually, I will use them in the future prob