AWS IAM PrivEsc: iam:PassRole → Lambda Escalation

Scenario

You hold low-privilege credentials (dev-ci) on a simulated AWS account. Their policy grants iam:PassRole together with lambda:CreateFunction and lambda:InvokeFunction — a classic privilege-escalation primitive, because Lambda runs as whatever execution role you pass to it.

Your task

This lab is a live IAM simulator — there is nothing to decode. Inspect the account, then submit the ordered chain of AWS/IAM actions that escalates you to admin:

1. Enumerate roles you may pass and find the admin-capable role that trusts lambda.amazonaws.com.
2. Pass that role to a new function with lambda:CreateFunction (authorised by iam:PassRole).
3. lambda:InvokeFunction — the function now executes with the admin role's permissions.
4. From inside that execution the function calls iam:AttachUserPolicy to attach AdministratorAccess to your own user.

Get the sequence right and the simulator returns your hc{...} flag. Everything is simulated — no real AWS account, role or credential is touched.