Today we are going to look into flaws.cloud it is a set of CTF-like challenges that teach you common security issues in AWS accounts. The game is about breaking into a real AWS account by exploiting badly crafted account permissions. It has 6 levels, we are going to look one by one
let’s start with level 1.
Level 1
This level is buckets of fun. See if you can find the first sub-domain.
Need a hint? Visit Hint 1
flaws.cloud is hosted on AWS which we found on Scope of this ctf . when you hear a name bucket in aws it refers to s3 storage bucket,
let us try to find subdomain we need to know about target domain ip and DNS records we are going to use tool called nslookup
so what is nslookup ?
nslookup is the name of a program that lets an Internet server administrator or any computer user enter a host name (for example, “whatis.com”) and find out the corresponding IP address or domain name system ( DNS ) record. The user can also enter a command for it to do a reverse DNS lookup and find the host name for an IP address that is specified
the web page flaws.cloud is hosted as a static website on S3 bucket in region “us-west-2”, which is region US West (Oregon). This is a great way to host a static site, similar to hosting one via github pages (our blog site is also hosted on github pages). Some interesting facts about S3 hosting: When hosting a site as an S3 bucket, the bucket name (flaws.cloud) must match the domain name (flaws.cloud). Also, S3 buckets are a global name space, meaning two people cannot have buckets with the same name. The result of this is you could create a bucket named microsoft.com and microsoft would never be able host their main site via S3 hosting.
Visiting 52.218.177.66 the ip address on web, your browser will direct you to https://aws.amazon.com/s3/ So you know flaws.cloud is hosted as an S3 bucket.
So we know it’s hosted in the AWS region us-west-2
Side note (not useful for this game): All S3 buckets, when configured for web hosting, are given an AWS domain you can use to browse to it without setting up your own DNS. In this case, flaws.cloud can also be visited by going to http://flaws.cloud.s3-website-us-west-2.amazonaws.com/
an AWS S3 static site, . A common misconfiguration for web servers is directory listing if it is misconfigured then unauthenticated users are granted permissions to list a bucket. This may reveal sensitive content, like the link to the next level.
Region and bucket name are enough to list the bucket. We use the AWS command line client for it. To make an unauthenticated request, use the flag “–no-sign-request”.
___________________||||/ || |__| |/___/|__||||o||||(\_||_||___||||||\__||_]|||_||` ' |/ \ |
| | | || | | \ / \ |
|__| |_____||__|__| \_/\_/ \___|
Congrats! You found the secret file!
Level 2 is at http://level2-c8b217a33fcf1f839f6f1f73a00a9ae7.flaws.cloud
we got link to level 2
Level 2
The next level is fairly similar, with a slight twist. You’re going to need your own AWS account for this. You just need the free tier For hints, see Hint 1
for this level we need AWS account and IAM user, if you don’t have create it
after sign-up
1
2
3
4
5
6
7
8
9
1. Open the IAM console.
2. In the navigation pane of the console, choose Users.
3. Choose your IAM user name (not the check box).
4. Choose the Security credentials tab and then choose Create access key.
5. To see the new access key, choose Show. Your credentials will look something like this:
Access key ID: AKIA4**********
Secret access key: iKllUgQDSJtYk*************************
6. To download the key pair, choose Download .csv file. Store the keys in a secure location.
7. Keep the keys confidential in order to protect your AWS account, and never email them. Do not share them outside your organization, even if an inquiry appears to come from AWS or Amazon.com. No one who legitimately represents Amazon will ever ask you for your secret key.
need to configure aws iam user credentials to aws cli
ubuntu@ubuntu-2204:~/Desktop$ curl http://level2-c8b217a33fcf1f839f6f1f73a00a9ae7.flaws.cloud/secret-e4443fc.html<html><head><title>flAWS</title><METANAME="ROBOTS"CONTENT="NOINDEX, NOFOLLOW"><style>body{font-family:AndaleMono,monospace;}:not(center)>pre{background-color:#202020;padding:4px;border-radius:5px;border-color:#00d000;border-width:1px;border-style:solid;}</style></head><bodytext="#00d000"bgcolor="#000000"style="max-width:800px; margin-left:auto ;margin-right:auto"vlink="#00ff00"link="#00ff00"><center><pre>___________________||||/ || |__| |/___/|__||||o||||(\_||_||___||||||\__||_]|||_||` ' |/ \ |
| | | || | | \ / \ |
|__| |_____||__|__| \_/\_/ \___|
</pre>
<h1>Congrats! You found the secret file!</h1>
</center>
Level 3 is at <a href="http://level3-9afd3927f195e10225021a578e6f78df.flaws.cloud">http://level3-9afd3927f195e10225021a578e6f78df.flaws.cloud</a>
we got Level 3 access
Level 3
The next level is fairly similar, with a slight twist. Time to find your first AWS key! I bet you’ll find something that will let you list what other buckets are. For hints, see Hint 1
like previous level let’s verify any directory listing is available or not
1
2
3
4
5
6
7
8
9
ubuntu@ubuntu-2204:~/Desktop$ aws s3 --profile default ls s3://level3-9afd3927f195e10225021a578e6f78df.flaws.cloud/PRE.git/2017-02-2619:14:33123637authenticated_users.png2017-02-2619:14:341552hint1.html2017-02-2619:14:341426hint2.html2017-02-2619:14:351247hint3.html2017-02-2619:14:331035hint4.html2020-05-2214:21:101861index.html2017-02-2619:14:3326robots.txt
we got some list of hints but look carefully we got .git directory which makes some interest to look into it. for that let us download the directory
1
2
3
4
5
6
7
8
ubuntu@ubuntu-2204:~/Desktop$ aws s3 sync s3://level3-9afd3927f195e10225021a578e6f78df.flaws.cloud.--no-sign-request--regionus-west-2download:s3://level3-9afd3927f195e10225021a578e6f78df.flaws.cloud/hint4.html to ./hint4.html
download:s3://level3-9afd3927f195e10225021a578e6f78df.flaws.cloud/robots.txt to ./robots.txt
download:s3://level3-9afd3927f195e10225021a578e6f78df.flaws.cloud/hint3.html to ./hint3.html
download:s3://level3-9afd3927f195e10225021a578e6f78df.flaws.cloud/index.html to ./index.html
download:s3://level3-9afd3927f195e10225021a578e6f78df.flaws.cloud/hint2.html to ./hint2.html
download:s3://level3-9afd3927f195e10225021a578e6f78df.flaws.cloud/hint1.html to ./hint1.html
download:s3://level3-9afd3927f195e10225021a578e6f78df.flaws.cloud/authenticated_users.png to ./authenticated_users.png
after installing git on our system. navigate to downloaded directory and type git log
we can see that there ware two comments, while look into the second comment Oops, accidentally added something I shouldn't have he developer or targeted user added something which is definitely don’t want other peoples to see. the good and bad thing about git is a version control we can revert back to the previous version of the document. let us see the difference between this first and second comment versions.
It’ll be useful to know that a snapshot was made of that EC2 shortly after nginx was setup on it. Need a hint? Go to Hint 1
if we visit the given link prompt asked to enter username and password. after performing brute forced and directory listing nothing worked, we know that the site is hosted in ubuntu on nginx server which is ec2 instance. question says the snapshot made after nginx was setup on it, if we found snapshot we can download and look into nginx config ware the passwords and configurations are stored.
we can snapshot the disk volume of an EC2 as a backup. In this case, the snapshot was made public, but we will need to find it.
To do this, first we need the account ID, which we can get using the AWS key from the previous level:
ware f3 is the profile 3 which is configured on previous level
Using that command also tells you the name of the account, which in this case is named “backup”. The backups this account makes are snapshots of EC2s. Next, discover the snapshot:
We specify the owner-id just to filter the output. For fun, run that command without the owner-id and notice all the snapshots that are publicy readable. By default snapshots are private, and we can transfer them between accounts securely by specifiying the account ID of the other account, but a number of people just make them public and forget about them it seems.
This snapshot is in us-west-2 You’re going to want to look in that snapshot.
Now that we know the snapshot ID, we need to mount it. we need to do this in our own AWS account, which you can get for free.
it take some time to start instance. point your mouse on top of instance name right click and select connect
you can able to see the connection steps
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
ubuntu@ubuntu-2204:~/Desktop$ sudo ssh -i "kp-l3.pem" ec2-user@ec2-34-216-207-4.us-west-2.compute.amazonaws.comTheauthenticityofhost'ec2-34-216-207-4.us-west-2.compute.amazonaws.com (34.216.207.4)'can't be established.
ED25519 key fingerprint is SHA256:rffHg5EdntpsnKxGDZc7A4ZHhIKL/lOiV5ColbyKs7s.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added 'ec2-34-216-207-4.us-west-2.compute.amazonaws.com'(ED25519)tothelistofknownhosts.__|__|_)_|(/ Amazon Linux 2 AMI___|\___|___|https://aws.amazon.com/amazon-linux-2/
2package(s)neededforsecurity,outof5availableRun"sudo yum update"toapplyallupdates.[ec2-user@ip-172-31-33-178~]$
[ec2-user@ip-172-31-33-178~]$cd/mnt/snapshot/[ec2-user@ip-172-31-33-178snapshot]$lsbinbootdevetchomeinitrd.imginitrd.img.oldliblib64lost+foundmediamntoptprocrootrunsbinsnapsrvsystmpusrvarvmlinuzvmlinuz.old[ec2-user@ip-172-31-33-178snapshot]$cdvar/www/html/[ec2-user@ip-172-31-33-178html]$lsindex.htmlrobots.txt[ec2-user@ip-172-31-33-178html]$catindex.html<html><head><title>flAWS</title><METANAME="ROBOTS"CONTENT="NOINDEX, NOFOLLOW"><style>body{font-family:AndaleMono,monospace;}</style></head><bodytext="#00d000"bgcolor="#000000"style="max-width:800px; margin-left:auto ;margin-right:auto"vlink="#00ff00"link="#00ff00"><center><pre>___________________||||/ || |__| |/___/|__||||o||||(\_||_||___||||||\__||_]|||_||` ' |/ \ |
| | | || | | \ / \ |
|__| |_____||__|__| \_/\_/ \___|
</pre>
<h1>flAWS - Level 5</h1>
</center>
Good work getting in. This level is described at <a href="http://level5-d2891f604d2061b6977c2481b0c8333e.flaws.cloud/243f422c/">http://level5-d2891f604d2061b6977c2481b0c8333e.flaws.cloud/243f422c/</a>
[ec2-user@ip-172-31-33-178 html]$
we got level 5 access
if we need password of the login, we already know the server of the site is nginx. the default password of the nginx is located on /etc/nginx/.htpasswd
Instead of going crazy on cracking it (which would fail) you can just look around a bit. What you will find is a setup script that generated the password file. It contains the password in clear text.
we have level 6 url, while try to access we can see that Access Denied because level 6 is hosted on sub directory for that we need to play level 5 properly
before that we already know what is APIPA ip , while computer starts our computer waits less then 6 seconds for DHCP response. if DHCP server isn’t reachable. then the computer automatically assign ip with in the range of APIPA (169.254.0.1 to 169.254.255.254)
according to aws documentation only access instance metadata and user data from within the instance itself, the data is not protected by authentication or cryptographic methods. Anyone who has direct access to the instance, and potentially any software running on the instance, can view its metadata. Therefore, you should not store sensitive data, such as passwords or long-lived encryption keys, as user data.
using metadata service ip lets try to fetch some information about target instance
ubuntu@ubuntu-2204:~/.aws$ curl http://level6-cc4c404a8a8b876167f5e70a7d8c9880.flaws.cloud/ddcc78ff/<html><head><title>flAWS-Level6</title><METANAME="ROBOTS"CONTENT="NOINDEX, NOFOLLOW"><style>body{font-family:AndaleMono,monospace;}</style></head><bodytext="#00d000"bgcolor="#000000"style="max-width:800px; margin-left:auto ;margin-right:auto"vlink="#00ff00"link="#00ff00"><center><pre>___________________||||/ || |__| |/___/|__||||o||||(\_||_||___||||||\__||_]|||_||` ' |/ \ |
| | | || | | \ / \ |
|__| |_____||__|__| \_/\_/ \___|
</pre>
<h1>flAWS - Level 6</h1>
</center>
<h3>Lesson learned</h3>
The IP address 169.254.169.254 is a magic IP in the cloud world. AWS, Azure, Google, DigitalOcean and others use this to allow cloud resources to find out metadata about themselves. Some, such as Google, have additional constraints on the requests, such as requiring it to use `Metadata-Flavor:Google` as an HTTP header and refusing requests with an `X-Forwarded-For` header. AWS has recently created a new IMDSv2 that requires special headers, a challenge and response, and other protections, but many AWS accounts may not have enforced it. If you can make any sort of HTTP request from an EC2 to that IP, you'll likely get back information the owner would prefer you not see.
<h4>Examples of this problem</h4>
<ul>
<li><a href="https://twitter.com/Agarri_FR">Nicolas Grégoire</a> discovered that prezi allowed you point their servers at a URL to include as content in a slide, and this allowed you to point to 169.254.169.254 which provided the access key for the EC2 intance profile (<a href="https://engineering.prezi.com/prezi-got-pwned-a-tale-of-responsible-disclosure-ccdc71bb6dd1?gi=c0ec39b6236a">link</a>). He also found issues with access to that magic IP with <a href="https://hackerone.com/reports/53088">Phabricator</a> and <a href="https://hackerone.com/reports/53004">Coinbase</a>.
</ul>
A similar problem to getting access to the IAM profile's access keys is access to the EC2's user-data, which people sometimes use to pass secrets to the EC2 such as API keys or credentials.
<h3>Avoiding this mistake</h3>
Ensure your applications do not allow access to 169.254.169.254 or any local and private IP ranges. Additionally, ensure that IAM roles are restricted as much as possible.
<hr size=3 color="#00d000" />
<h1>Level 6</h1>
For this final challenge, you're getting a user access key that has the SecurityAudit policy attached to it. See what else it can do and what else you might find in this AWS account.
<p>Access key ID: AKIAJFQ6E7BY57Q3OBGA<br>
Secret: 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<br>
<p>Need a hint? Go to <a href="./hint1.html">Hint 1</a>
<br><br><br><br><br><br><br><br><br><br><br><br><br><br><br>ubuntu@ubuntu-2204:~/.aws$
