search
blog

State of Affairs

hashtag
Challenge Description

This challenge involves exploiting a Terraform environment with restricted permissions to escalate privileges and retrieve the flag.

hashtag
Table of Contents

hashtag
Solution Overview

This challenge demonstrates a Terraform state file poisoning attack through a race condition:

  1. Enumeration - Discover Terraform configuration files and cronjob behavior

  2. Provider Analysis - Analyze installed Terraform providers and versions

  3. Race Condition Identification - Find timing window before terraform files are initialized

  4. State File Poisoning - Create malicious terraform.tfstate with code execution payload

  5. Flag Retrieval - Execute command to copy flag with elevated privileges

Key Vulnerability: Race condition in cronjob allows injecting malicious state file that executes arbitrary commands via the statefile-rce provider technique.

hashtag
Initial Analysis

Upon accessing the environment, we have limited privileges as the ctf user and need to escalate to access the flag.

hashtag
File System Enumeration

Key findings:

  • The ctf user only has read permissions for main.tf, server.crt and .terraform.lock.hcl

  • Limited filesystem access suggests we need to find another attack vector

  • Terraform lock file is readable and may contain valuable information

hashtag
Terraform Lock File Analysis

The Terraform lock file reveals the installed providers and their versions:

Provider Analysis:

From the Terraform lock file, we identified three installed providers:

  • registry.terraform.io/hashicorp/local - version 2.6.1 (latest)

  • registry.terraform.io/hashicorp/time - version 0.9.2 (outdated, current: 0.13.1)

  • registry.terraform.io/hashicorp/tls - version 4.1.0 (latest)

While the time provider is outdated, no known exploits exist for version 0.9.2.

Initial Terraform Commands:

Attempting to run terraform plan or terraform apply returns an error:

The error indicates we don't have sufficient permissions to read the required Terraform configuration files.

hashtag
Cronjob Discovery

Using pspy to monitor processes, we discovered that supercronic is being used to execute scheduled tasks:

Crontab Contents:

Analysis:

  • The cronjob runs every minute

  • Executes terraform init followed by terraform apply -auto-approve

  • Runs as the tfuser with elevated privileges

  • Logs output to /var/tmp/tfoutput.log

Note: We don't have write permissions to the crontab, so traditional cronjob privilege escalation won't work.

Terraform Output Analysis:

Since the cronjob runs every minute, we can examine the output log to understand what Terraform is doing:

Key Observations:

  • Terraform is managing TLS certificates and keys

  • Resources are being replaced every minute due to replace_triggered_by

  • The state includes time_static, tls_private_key, tls_self_signed_cert, and local_file resources

  • All operations run with tfuser privileges

Temporary Files Discovery:

Examining the /tmp folder reveals Terraform state files:

A second terraform.tfstate file exists in .terraform/:

Permission Analysis:

  • All files and directories are owned by tfuser:tfgroup

  • We cannot write or modify existing state files

  • This limits direct state file modification attacks

hashtag
Identifying the Vulnerability

hashtag
Race Condition Discovery

A critical behavior was discovered: Terraform files are not instantiated immediately when the environment spawns.

Observation:

When the instance first spawns:

  • No Terraform files exist in /tmp

  • No provider plugins are installed

  • Files appear approximately 1 minute after spawn

  • This creates a race condition window where we can inject our own files

hashtag
State File Code Execution

The race condition enables Terraform state file poisoning, a technique documented in HackTricksarrow-up-right:

Attack Technique:

The terraform-provider-statefile-rcearrow-up-right project demonstrates how malicious state files can achieve code execution:

When terraform init is executed with a compromised state file, Terraform will attempt to download and initialize providers referenced in the state, including malicious ones that execute arbitrary code during initialization.

Exploit Requirements:

  1. Ability to create/modify a terraform.tfstate file

  2. terraform init must be executed (satisfied by the cronjob)

  3. Malicious provider reference in the state file

hashtag
Exploitation

hashtag
Creating Malicious State File

The exploit payload uses a offensive-actions/statefile-rce provider that executes commands during initialization:

Payload Structure:

Command Explanation:

  • cp /home/tfuser/flag /tmp/flag - Copy the flag to a readable location

  • chmod 777 /tmp/flag - Make the flag readable by all users

Complete Malicious State File:

hashtag
Exploiting the Race Condition

Attack Steps:

  1. Restart the instance to reset the environment

  2. Immediately execute the following command before the cronjob runs

  3. Wait for the cronjob to execute terraform init

Exploitation Command:

What this command does:

  1. Decodes the base64-encoded malicious state file

  2. Writes it to /tmp/terraform.tfstate

  3. Sets permissions to ensure it's readable by the cronjob

Execution:

Monitoring for Success:

Watch the /tmp directory for the flag file to appear:

hashtag
Getting the Flag

After approximately one minute, the cronjob executes terraform init, which:

  1. Reads our malicious state file

  2. Attempts to initialize the fake statefile-rce provider

  3. Executes our command with tfuser privileges

  4. Copies the flag to /tmp/flag with full permissions

Success!

Summary:

  1. Identified a race condition in Terraform initialization timing

  2. Discovered cronjob running terraform init and apply every minute

  3. Crafted malicious state file using the statefile-rce provider technique

  4. Exploited race condition window to inject poisoned state file before legitimate initialization

  5. Achieved code execution as tfuser to retrieve the flag

Flag: WIZ_CTF{B00tTh3St4t3_Trust_N0_Pr0v1d3r}

PreviousMalware Busters!NextDefCon Cloud Village 2025

Last updated