Ghosts in the Cloud Hijacking Orphaned Azure Blob Storage

src/SUMMARY.md

@@ -1045,12 +1045,14 @@
     - [AWS - Amazon Connect Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-connect-privesc/README.md)
     - [AWS - Config Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-config-privesc/README.md)
     - [AWS - Control Tower Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-control-tower-privesc/README.md)
+    - [AWS - Customer Profiles Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-customer-profiles-privesc/README.md)
     - [AWS - Datapipeline Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-datapipeline-privesc/README.md)
     - [AWS - DataZone Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-datazone-privesc/README.md)
     - [AWS - Device Farm Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-device-farm-privesc/README.md)
     - [AWS - DLM Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-dlm-privesc/README.md)
     - [AWS - Directory Services Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-directory-services-privesc/README.md)
     - [AWS - DynamoDB Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-dynamodb-privesc/README.md)
+    - [AWS - EBS Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-ebs-privesc/README.md)
     - [AWS - EC2 Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-privesc/README.md)
     - [AWS - EC2 Image Builder Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-ec2-image-builder-privesc/README.md)
     - [AWS - ECR Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-ecr-privesc/README.md)
@@ -1061,6 +1063,7 @@
     - [AWS - Elastic Beanstalk Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-elastic-beanstalk-privesc/README.md)
     - [AWS - EMR Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-emr-privesc/README.md)
     - [AWS - EMR Serverless & EMR on EKS Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-emr-serverless-privesc/README.md)
+    - [AWS - Entity Resolution Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-entity-resolution-privesc/README.md)
     - [AWS - EventBridge Pipes Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-eventbridge-pipes-privesc/README.md)
     - [AWS - EventBridge Scheduler Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/eventbridgescheduler-privesc/README.md)
     - [AWS - EventBridge Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-eventbridge-privesc/README.md)
@@ -1069,30 +1072,39 @@
     - [AWS - Glue Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-glue-privesc/README.md)
     - [AWS - HealthOmics Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-healthomics-privesc/README.md)
     - [AWS - IAM Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-iam-privesc/README.md)
+    - [AWS - Invoicing and Billing Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-invoicing-and-billing-privesc/README.md)
     - [AWS - IoT Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-iot-privesc/README.md)
     - [AWS - IoT SiteWise Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-iot-sitewise-privesc/README.md)
+    - [AWS - IoT TwinMaker Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-iot-twinmaker-privesc/README.md)
+    - [AWS - IVS Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-ivs-privesc/README.md)
     - [AWS - Kinesis Data Streams Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-kinesis-data-streams-privesc/README.md)
     - [AWS - KMS Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-kms-privesc/README.md)
     - [AWS - Lambda Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc/README.md)
+    - [AWS - Lex V2 Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-lex-v2-privesc/README.md)
     - [AWS - Lightsail Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-lightsail-privesc/README.md)
     - [AWS - Macie Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-macie-privesc/README.md)
     - [AWS - Mainframe Modernization Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-mainframe-modernization-privesc/README.md)
+    - [AWS - Managed Blockchain Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-managed-blockchain-privesc/README.md)
     - [AWS - Managed Service for Apache Flink Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-managed-flink-privesc/README.md)
     - [AWS - Mediapackage Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-mediapackage-privesc/README.md)
+    - [AWS - MemoryDB ACL User Reset Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-memorydb-user-reset-privesc/README.md)
     - [AWS - Migration Hub Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-migration-hub-privesc/README.md)
     - [AWS - Migration Hub Orchestrator Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-migration-hub-orchestrator-privesc/README.md)
     - [AWS - MQ Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-mq-privesc/README.md)
+    - [AWS - MSK Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-msk-privesc/README.md)
     - [AWS - OpenSearch Serverless Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-opensearch-serverless-privesc/README.md)
     - [AWS - Oracle Database@AWS Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-odb-privesc/README.md)
     - [AWS - PassRole to ML/Analytics Data-Access Roles](pentesting-cloud/aws-security/aws-privilege-escalation/aws-ml-dataaccess-passrole-privesc/README.md)
     - [AWS - Payment Cryptography Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-payment-cryptography-privesc/README.md)
     - [AWS - PCA Connector for AD Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-pca-connector-ad-privesc/README.md)
     - [AWS - Proton Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-proton-privesc/README.md)
+    - [AWS - Q Business Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-q-business-privesc/README.md)
     - [AWS - QuickSight Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-quicksight-privesc/README.md)
     - [AWS - RDS Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc/README.md)
     - [AWS - Redshift Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-redshift-privesc/README.md)
     - [AWS - Resilience Hub Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-resilience-hub-privesc/README.md)
     - [AWS - ARC Region Switch Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-region-switch-privesc/README.md)
+    - [AWS - Route 53 Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/route53-createhostedzone-route53-changeresourcerecordsets-acm-pca-issuecertificate-acm-pca-getcer/README.md)
     - [AWS - Route 53 Domains Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-route53-domains-privesc/README.md)
     - [AWS - SNS Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-sns-privesc/README.md)
     - [AWS - SQS Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-sqs-privesc/README.md)
@@ -1111,9 +1123,12 @@
     - [AWS - Fault Injection Service Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-fis-privesc/README.md)
     - [AWS - Step Functions Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-stepfunctions-privesc/README.md)
     - [AWS - STS Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-sts-privesc/README.md)
+    - [AWS - Timestream Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-timestream-privesc/README.md)
     - [AWS - Transfer Family Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-transfer-family-privesc/README.md)
     - [AWS - Verified Permissions Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-verified-permissions-privesc/README.md)
+    - [AWS - Wickr Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-wickr-privesc/README.md)
     - [AWS - WorkSpaces Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-workspaces-privesc/README.md)
+    - [AWS - WorkSpaces Applications Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-workspaces-appstream-privesc/README.md)
     - [AWS - WorkDocs Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-workdocs-privesc/README.md)
   - [AWS - Services](pentesting-cloud/aws-security/aws-services/README.md)
     - [AWS - Security Agent Enum](pentesting-cloud/aws-security/aws-services/aws-security-agent-enum.md)

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-customer-profiles-privesc/README.md

@@ -14,15 +14,15 @@ Customer Profiles has no generic compute primitive and does not return IAM role
 
 ## `CreateIntegrationWorkflow` + `iam:PassRole`
 
-This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-customer-profiles-post-exploitation/README.md#createintegrationworkflow--iampassrole). It does not establish another AWS principal or a new IAM permission grant.
+This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-customer-profiles-post-exploitation/#createintegrationworkflow--iampassrole). It does not establish another AWS principal or a new IAM permission grant.
 
 ## `CreateSegmentSnapshot` + `iam:PassRole`
 
-This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-customer-profiles-post-exploitation/README.md#createsegmentsnapshot--iampassrole). It does not establish another AWS principal or a new IAM permission grant.
+This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-customer-profiles-post-exploitation/#createsegmentsnapshot--iampassrole). It does not establish another AWS principal or a new IAM permission grant.
 
 ## `AssociateStreamForSegments` + `iam:PassRole`
 
-This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-customer-profiles-post-exploitation/README.md#associatestreamforsegments--iampassrole). It does not establish another AWS principal or a new IAM permission grant.
+This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-customer-profiles-post-exploitation/#associatestreamforsegments--iampassrole). It does not establish another AWS principal or a new IAM permission grant.
 
 ## Confused-deputy and trust-policy boundary
 

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-ebs-privesc/README.md

@@ -12,11 +12,11 @@ For more information about EBS access:
 
 ### `ebs:ListSnapshotBlocks`, `ebs:GetSnapshotBlock`, `ec2:DescribeSnapshots`
 
-This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md#ebslistsnapshotblocks-ebsgetsnapshotblock-ec2describesnapshots). It does not establish another AWS principal or a new IAM permission grant.
+This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/#ebslistsnapshotblocks-ebsgetsnapshotblock-ec2describesnapshots). It does not establish another AWS principal or a new IAM permission grant.
 
 ### **`ec2:CreateSnapshot`**
 
-This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/README.md#ec2createsnapshot). It does not establish another AWS principal or a new IAM permission grant.
+This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/#ec2createsnapshot). It does not establish another AWS principal or a new IAM permission grant.
 
 ## References
 

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-entity-resolution-privesc/README.md

@@ -12,7 +12,7 @@ For more information about Entity Resolution access:
 
 ## Pass a workflow role to read and export identity data
 
-The bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-entity-resolution-post-exploitation/README.md#pass-a-workflow-role-to-read-and-export-identity-data). It does not establish another AWS principal or a new IAM grant.
+The bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-entity-resolution-post-exploitation/#pass-a-workflow-role-to-read-and-export-identity-data). It does not establish another AWS principal or a new IAM grant.
 
 ## References
 

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-invoicing-and-billing-privesc/README.md

@@ -12,27 +12,27 @@ For more information about AWS Invoicing and Billing access:
 
 ## No direct IAM role escalation primitive
 
-This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/README.md#no-direct-iam-role-escalation-primitive). It does not establish another AWS principal or a new IAM permission grant.
+This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/#no-direct-iam-role-escalation-primitive). It does not establish another AWS principal or a new IAM permission grant.
 
 ## Turn cost-view administration into cross-account disclosure
 
-This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/README.md#turn-cost-view-administration-into-cross-account-disclosure). It does not establish another AWS principal or a new IAM permission grant.
+This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/#turn-cost-view-administration-into-cross-account-disclosure). It does not establish another AWS principal or a new IAM permission grant.
 
 ## Enable previously granted legacy Billing permissions
 
-This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/README.md#enable-previously-granted-legacy-billing-permissions). It does not establish another AWS principal or a new IAM permission grant.
+This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/#enable-previously-granted-legacy-billing-permissions). It does not establish another AWS principal or a new IAM permission grant.
 
 ## Abuse invoice receiver delegation
 
-This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/README.md#abuse-invoice-receiver-delegation). It does not establish another AWS principal or a new IAM permission grant.
+This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/#abuse-invoice-receiver-delegation). It does not establish another AWS principal or a new IAM permission grant.
 
 ## The Billing service-linked role is not a general escalation target
 
-This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/README.md#the-billing-service-linked-role-is-not-a-general-escalation-target). It does not establish another AWS principal or a new IAM permission grant.
+This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/#the-billing-service-linked-role-is-not-a-general-escalation-target). It does not establish another AWS principal or a new IAM permission grant.
 
 ## Related actions that amplify business impact, not IAM authority
 
-This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/README.md#related-actions-that-amplify-business-impact-not-iam-authority). It does not establish another AWS principal or a new IAM permission grant.
+This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-invoicing-and-billing-post-exploitation/#related-actions-that-amplify-business-impact-not-iam-authority). It does not establish another AWS principal or a new IAM permission grant.
 
 ## References
 

src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-iot-twinmaker-privesc/README.md

@@ -12,11 +12,11 @@ For more information about IoT TwinMaker access:
 
 ## Connector invocation without direct Lambda permission
 
-This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-iot-twinmaker-post-exploitation/README.md#connector-invocation-without-direct-lambda-permission). It does not establish another AWS principal or a new IAM permission grant.
+This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-iot-twinmaker-post-exploitation/#connector-invocation-without-direct-lambda-permission). It does not establish another AWS principal or a new IAM permission grant.
 
 ## `UpdateWorkspace` + `iam:PassRole` + connector control
 
-This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-iot-twinmaker-post-exploitation/README.md#updateworkspace--iampassrole--connector-control). It does not establish another AWS principal or a new IAM permission grant.
+This bounded data or application operation is documented in [AWS post exploitation](../../aws-post-exploitation/aws-iot-twinmaker-post-exploitation/#updateworkspace--iampassrole--connector-control). It does not establish another AWS principal or a new IAM permission grant.
 
 ## References