For the sixth CloudGoat scenario, EC2 SSRF, we are tasked with invoking a Lambda function, which can only be done with admin rights. The start file contains a set of IAM user credentials that give us entry into the AWS account. From there, there is a sequence of privilege escalations that result from different IAM […]
CloudGoat Series #6: EC2 SSRF Read More »
For the fifth CloudGoat scenario, “IAM Privesc by Attachment”, we are presented with an IAM user’s access keys and are tasked with deleting an EC2 instance called the “super-critical-security-server”. We find that the IAM user has some permissions to both the IAM and EC2 services. With these, we identify an interesting pair of roles, an
CloudGoat Series #5: IAM Privesc by Attachment Read More »
CloudGoat’s fourth scenario, “Cloud Breach S3”, is a short and easy scenario that demonstrates abuse of the EC2 metadata service. For once, we do not start off with an IAM user’s access keys. Instead, we are given the IP address of a reverse proxy server that has been poorly configured and are tasked with simulating
CloudGoat Series #4: Cloud Breach S3 Read More »
“Lambda Privesc” is CloudGoat’s third scenario, and it beings with us having an IAM user’s access keys. When we enumerate the user’s permission set, we find they are able to carry out any action within the Lambda service. There is also a special IAM permission that allows the user to pass any role to the
CloudGoat Series #3: Lambda Privesc Read More »
CloudGoat’s second scenario, titled “IAM Privesc by Rollback”, is an extremely short scenario that teaches AWS IAM policy and versioning. Once again, we’re given access keys for an IAM user and need to gain administrator-level access. However, our path to get there is different in that we need to tamper with the policies available to
CloudGoat Series #2: IAM Privesc by Rollback Read More »
In this post, we’re going to walk through the first scenario of CloudGoat titled “Vulnerable Lambda”. If you don’t know what CloudGoat is or how to start using it, I recommend you check out my previous post to get started. “Vulerable Lambda” is a gentle introduction to cloud penetration testing in AWS and only requires you
CloudGoat Series #1: Vulnerable Lambda Read More »
CloudGoat is an open source tool (courtesy of Rhino Security Labs) that allows security professionals to create and learn from an intentionally vulnerable AWS cloud environment. If you’re familiar with pen testing labs such as HackTheBox or TryHackMe, this is basically the same concept but for AWS. Resources for doing cloud pen testing are pretty scarce in
CloudGoat Series #0: Getting Started Read More »
I’ve recently completed the Bug Bounty Hunter job-role path on HTB Academy, which was a fun and challenging ride. Overall, I found it enjoyable and learned some new skills. Isn’t that always a plus? The content actually helped me better prepare for my most recent round of technical interviews. Even though these all sound like
Academy Bug Bounty Hunter Path Review Read More »
Today’s post is a walkthrough of the Timelapse machine from HackTheBox. This is an easy Windows machine that is set up like a domain controller. To get an initial foothold, a few steps of password cracking and certificate magic are involved. Once on the server, a service account is discovered. Further enumeration reveals it has
HackTheBox Writeup: Timelapse Read More »
In this post, we’re going to take a look at the Insekube room from TryHackMe. This room teaches some security concepts around Kubernetes. It assumes basic knowledge of Kubernetes, so if you aren’t familiar with it, I recommend at least reviewing the high-level architecture in the Kubernetes documentation. Since this is a lab environment with
TryHackMe Writeup: Insekube Read More »