Redboto

A YARA interactive debugger for the YARA language written in Rust, providing features like function calls, constant evaluation, and string matching.

Redboto is a set of scripts that utilize the Amazon SDK for Python, known as boto3, to conduct red team operations against the AWS API. To install the necessary libraries, run the following command: $ pip install cryptography boto3 texttable getEC2WinCreds.py. If you possess the correct API key and .pem file, you can download and decrypt the initial Windows password for an AWS instance using getEC2Files.py. This script is undoubtedly the most complex one in the collection.

This script works effectively alongside describeInstances.py, which provides metadata about instances in EC2. With a properly configured API key that has the necessary permissions, you can extract files from an EC2 instance.

The script takes a snapshot of a target volume. It then launches an instance to attach to the volume and creates an S3 bucket. Once the instance finishes launching, it encrypts the selected files and copies them to the S3 bucket. Finally, the script retrieves the files from the S3 bucket and decrypts them.

The script then dismantles the infrastructure it has built, leaving behind only logs, if this feature is enabled.