WIZ Big IAM Challenge WriteUp
2023-11-23
| 2024-3-30
0  |  阅读时长 0 分钟
type
status
date
slug
summary
tags
category
icon
password
The Big IAM Challenge
Put yourself to the test with our unique CTF challenge and boost your AWS IAM knowledge. Do you have what it takes to win The Big IAM Challenge?
The Big IAM Challenge
https://bigiamchallenge.com/
The Big IAM Challenge
发现 aws 查看自己有啥权限都要分配的，比如（aws iam get-user 、aws iam list-attached-user-policies --user-name test），所以题目在前端页面告诉我们这个关卡我们有啥权限

Challenger1 - Buckets of Fun

We all know that public buckets are risky. But can you find the flag?
题目 IAM Policy
看了下 IAM 的一些字段说明 IAM policies_elements 如 Principal 等 以及 arn 介绍 Amazon Resource Names (ARNs)
资源名称:主题:服务:区域:账号id:资源id（资源类型/资源id 或 资源类型:资源id）
部分字段可置空，直接 :: 拼接
 
题目设置允许列桶 thebigiamchallenge-storage-9979f4b
aws list-objects 使用
获取 flag
如果在非CTF挑战页面请求，需要加上 --no-sign-request 参数，如
aws 还有一种使用方式是

Challenger2 - Google Analytics

We created our own analytics system specifically for this challenge. We think it's so good that we even used it on this page. What could go wrong?
Join our queue and get the secret flag.
题目 IAM Policy
参考 sqs send-message 和 sqs receive-message 需要得知 queue-url 大概长这样https://sqs.us-east-1.amazonaws.com/80398EXAMPLE/MyQueue
 
view-source:https://bigiamchallenge.com/challenge/2 查看 js 代码部分
得知 QueueUrl
请求 Body 的 URL 即可得到 flag
 
拓展：
如果是非CTF页面的控制台呢？
注意到 JS 代码一开始用获取凭证的过程，Amazon Cognito 是将用户注册和登录功能以及控制访问添加到自研的 Web 和移动应用程序
 
转换为 cli 命令就是
即先从认证池生成认证id
 
通过认证id生成临时凭据
 
创建一个 profile
设置 aws_session_token
使用设置的 profile 请求
在访问 Body 里的 URL 即可得 flag
 

Challenge3 - Enable Push Notifications

We got a message for you. Can you get it?
题目 IAM Policy
aws sns subscribe 得知，需要传入两个必选参数 --topic-arn 和 --protocol ， IAM 策略定义 --notification-endpoint 地址需要满足以 @tbic.wiz.io 结尾。 subscribe 官方的 example 是 email 协议，但我们没这个邮件，可通过 http 协议 来满足这个条件
服务端 nc 监听两遍即可
在 Message 处得到 flag

Challenge4 - Admin only?

We learned from our mistakes from the past. Now our bucket only allows access to one specific admin user. Or does it?
题目 IAM Policy
Condition逻辑解释 StringLike 等价于 ForAllValues:StringLike ，因此 ListBucket 里的这两个条件其实是 OR 逻辑，也就是满足其中一个即可
其实直接用第一个题目的命令也是可以的，也满足条件
 
获取 flag

Challenge4 - Do I know you?

We configured AWS Cognito as our main identity provider. Let's hope we didn't make any mistakes.
题目 IAM Policy
和 Challenge2 拓展的方法类似，通过 f12 看源码，先从认证池生成认证id
通过认证id生成临时凭据
设置凭据
aws 会自动从环境变量中获取凭据
获取flag

Challenge6 - One final push

Anonymous access no more. Let's see what can you do now. Now try it with the authenticated role: arn:aws:iam::092297851374:role/Cognito_s3accessAuth_Role
题目 IAM Policy
us-east-1:b73cb2d2-0d00-4e77-8e80-f99d9c13da3b 这个身份可以模拟角色，先拿到这个身份的 token
这里需要获取 open-id-token，见 AssumeRoleWithWebIdentity
模拟并获取题目提示的角色凭据
设置凭据
获取 flag
 
Certificate
notion image
 

Reference

bigiamchallenge AWS IAM Challenges
Welcome to my blog! In this post, I’ll be sharing my solutions to the challenges presented by bigiamchallenge.com. The Big IAM Challenge is…
bigiamchallenge AWS IAM Challenges
https://pswalia2u.medium.com/bigiamchallenge-aws-iam-challenges-ded45cb983f2
bigiamchallenge AWS IAM Challenges
The Big IAM Challenge: CTF Walkthrough
Recently I came across The Big IAM Challenge. It is a cloud security Capture The Flag (CTF) event. The challenge consists of 6 steps, with each one focusing on a common IAM configuration mistake in various AWS services. I thought I’ll do a write-up for this CTF challenge. I encourage you’ll to give this a solid try and only use this guide if you’re stuck at a particular level. Challenge 1: Buckets of Fun We all know that public buckets are risky.
The Big IAM Challenge: CTF Walkthrough
https://iash.dev/posts/the-big-iam-challenge-ctf-walkthrough/
相关文章 :
  • 云安全
  • AWS
  • CTF
  • Writeup
  • Wiz-CTF
    • WIZ EKS Cluster Games CTF WriteUp通过Falco检测K8S容器逃逸行为
    • GitTalk
    目录