> For the complete documentation index, see [llms.txt](https://kabinet.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kabinet.gitbook.io/ctf-writeup/2025/thuderdome/pulled-from-the-sky.md).

# Pulled from the sky

## Solve

Whilst on the AWS Console, lets utilize the Console User Interface to enumerate.

<figure><img src="/files/HxofGrHLQ7ph9qt7VQEk" alt=""><figcaption><p>More IAM username added to loot</p></figcaption></figure>

<figure><img src="/files/NZIhZkllbmWsB3tzMFU0" alt=""><figcaption><p>Policies, however we dont have permission to get the actual policy but good to take note</p></figcaption></figure>

<figure><img src="/files/ZVOjI8ZwHLt4BOcBQquh" alt=""><figcaption><p>EC2 running instances</p></figcaption></figure>

<figure><img src="/files/mTiaSTx4NVgDAl998gWy" alt=""><figcaption><p>No permission over s3</p></figcaption></figure>

We identified that there are 2 EC2 instances running

* admin 54.211.110.193
* web-prod 44.208.228.94

<figure><img src="/files/plPW2HC1JsDblMqWZhcy" alt=""><figcaption><p>AMI owned by haru</p></figcaption></figure>

<figure><img src="/files/azLe7iipaFupqAXNLjC7" alt=""><figcaption><p>snapshot owned by haru</p></figcaption></figure>

As we do not have access to the EC2 machine via SSM, the second best option will be to look into the snapshot to see if theres any sensitive files inside.

First lets configure the credential we get from the previous flag, and verify that it is working properly.

<figure><img src="/files/fMmj58y6ebrr0CgChFvw" alt=""><figcaption></figcaption></figure>

Next, refering to [HackTricks](https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-snapshot-dump.html) and [RhinoSecurityLabs](https://rhinosecuritylabs.com/aws/exploring-aws-ebs-snapshots/) article, we will be dumping the snapshot. For the exact instruction on installing and utlizing dsnap, please refer to the article.

<figure><img src="/files/aC8j869D1HjvvkBVx1GK" alt=""><figcaption><p>installing dsnap using pipx</p></figcaption></figure>

<figure><img src="/files/Q5rM008LgBfJufUyKppc" alt=""><figcaption><p>downloading the snapshot using dsnap</p></figcaption></figure>

<figure><img src="/files/sNXygnU6MNJuRlRbtKRQ" alt=""><figcaption><p>building the docker container</p></figcaption></figure>

<figure><img src="/files/hGyBYI80a2wkAknj7u8g" alt=""><figcaption><p>running the docker container and dropping into a shell</p></figcaption></figure>

Doing some manual enumeration of the file system, we found a few interesting files/folders

* /home/nacer/.azure
* /root/.aws/credentials
* /home/nacer/.aws/credentials

However, when attempting to use those credentials, they are unusable, most likely due to them expiring or been rotated out.

However, I'm able to retrieve the private and public key in the `/home/nacer/.ssh` folder

<figure><img src="/files/ZA9cS2anoNgk8kbSbBhi" alt=""><figcaption><p>nacer private key redacted</p></figcaption></figure>

Copying out the private key, lets attempt to use it to SSH into the web-prod server.

<figure><img src="/files/zmwbff17TDfjUdRIwXR9" alt=""><figcaption><p>Succesful SSH</p></figcaption></figure>

Recall how previously we tried using thne credentials that we have found in the docker container, but they were unusable, we have gotten our answer. The AWS Keys are set to rotate daily.

Lets copy out the current nacer key.

<figure><img src="/files/edIv77h2qmKePl4g7hu8" alt=""><figcaption><p>nacer aws credentials</p></figcaption></figure>

In [Flag 1](/ctf-writeup/2025/thuderdome/emerge-through-the-breach.md), we have a S3 bucket that haru wasn't able to access. Lets try using nacer credentials to access the bucket now.

<figure><img src="/files/Ao1fvgDsJK8jOOveUgxt" alt=""><figcaption><p>able to list bucket</p></figcaption></figure>

<figure><img src="/files/2OzqyhdW2z3HMZDfz3VS" alt=""><figcaption><p>able to also get bucket objects</p></figcaption></figure>

We have manged to then retrieve the flag succesfully from the s3 bucket.

<figure><img src="/files/P4wpWitDyjI4fP4l7ZYb" alt=""><figcaption><p>redacted flag.txt</p></figcaption></figure>

## TLDR

* Enumerate AWS console with Haru Credentials
* Identify EC2 running along with snapshots
* Utilize dsnap to dump snapshot
* Within the snapshot, contains a private key
* Utilize the private key to SSH into the web-prod EC2 instance and get nacer access key id and access key secret
* Retrieve flag from S3

## Reference

* <https://cloud.hacktricks.wiki/en/pentesting-cloud/aws-security/aws-post-exploitation/aws-ec2-ebs-ssm-and-vpc-post-exploitation/aws-ebs-snapshot-dump.html>
* <https://rhinosecuritylabs.com/aws/exploring-aws-ebs-snapshots/>