> For the complete documentation index, see [llms.txt](https://kabinet.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kabinet.gitbook.io/ctf-writeup/2025/thuderdome.md).

# Thuderdome

ThunderDome is a fun and immersive multi-cloud cyber range that simulates a realistic company environment across AWS, Azure and GCP. You can expect to learn a lot about the "big three" cloud platforms, token abuse, web exploitation, Windows and Linux, and a lot more

To learn more: <https://cyber-ranges.pwnedlabs.io/thunderdome-overview#overview>

| Challenge                                                                              | Cloud Environment |
| -------------------------------------------------------------------------------------- | ----------------- |
| [Emerge through the breach](/ctf-writeup/2025/thuderdome/emerge-through-the-breach.md) | AWS               |
| [Pulled from the sky](/ctf-writeup/2025/thuderdome/pulled-from-the-sky.md)             | AWS               |
| [An absent defense](/ctf-writeup/2025/thuderdome/an-absent-defense.md)                 | Azure             |
| [A new wave (web of deceit)](/ctf-writeup/2025/thuderdome/a-new-wave-web-of-deceit.md) | Azure             |
| [Crossing the great divide](/ctf-writeup/2025/thuderdome/crossing-the-great-divide.md) | GCP               |
| [Joining forces as one](/ctf-writeup/2025/thuderdome/joining-forces-as-one.md)         | GCP               |
| [Infiltrate (open the gate)](/ctf-writeup/2025/thuderdome/infiltrate-open-the-gate.md) | GCP               |
| [Jaeger](/ctf-writeup/2025/thuderdome/jaeger.md)                                       | AWS               |
| [Victory](/ctf-writeup/2025/thuderdome/victory.md)                                     | Azure             |

***

## Review

Thunderdome is an advanced multi-cloud cybersecurity training environment that simulates a realistic enterprise network across AWS, GCP, and Azure platforms. The lab presents a red team engagement scenario targeting a fictional pharmaceutical company, "Massive Pharma," which has recently migrated their infrastructure to the cloud with assumptions of default security adequacy.

This write-up will document my findings, the challenges I faced during the lab, and my overall approach. I tackled ThunderDome using a CTF player methodology, prioritizing flag hunting and moving aggressively through the environment.

Feel free to contact me on Discord @kabiet01 if theres any queries.

Note: All flag and credentials is redacted as per PwnedLabs request

<figure><img src="/files/W8XG9UNq2OmWqRnqFYrm" alt=""><figcaption></figcaption></figure>

## Acknowledgement

Special thanks to the moderators at PwnedLab discord for answering my question. Huge shoutout to Yasir for replying to my spam whenever I got stuck :pray: