Vulnmachines - Misconfigured S3 Bucket Writeup

Challenge Info

• Platform: Vulnmachines
• Category: Cloud Labs / AWS
• Description: "AWS S3 Bucket Misconfiguration Challenge"
• Challenge link: https://account.vulnmachines.com/user/challenges

Walkthrough

Step 1: Initial Recon

Visiting the challenge URL, I noticed the site was hosted on an AWS S3 bucket:

https://vnm-sec-aws.s3.amazonaws.com/admin/var/html/index.html

Key observations:

• The URL format reveals this is an S3 bucket: vnm-sec-aws
• The site renders fine, but it's just a static page
• Viewing the source turned up no obvious flag

Step 2: Probing the S3 Permission Structure

I tried listing directories at different levels:

# Test the root directory
curl -I https://vnm-sec-aws.s3.amazonaws.com/
# Result: 403 Forbidden

# Test the admin directory
curl https://vnm-sec-aws.s3.amazonaws.com/admin/
# Result: 403 AccessDenied

# But specific files are accessible
curl https://vnm-sec-aws.s3.amazonaws.com/admin/var/html/index.html
# Result: 200 OK, returns HTML content

A pattern emerged:

• Directory listing is impossible (403 errors)
• But specific files can be accessed (if you know the full path)

Step 3: Attempting Unauthenticated Access

Using AWS CLI in unsigned mode:

aws s3 ls s3://vnm-sec-aws/ --no-sign-request
# Result: Access Denied

Key finding: this bucket is configured with "Authenticated Users" permissions, meaning you need valid AWS credentials to list its contents.

Step 4: Sign Up for a Free AWS Account

Step 5: Create an IAM User

After logging in to the AWS Console:

1. Search for and open the "IAM" service
2. Click "Users" → "Create user"
3. Username: your choice
4. Key step: create an access key for the user, choosing "CLI" as the use case for the access key
5. Download the credentials:
   • Access Key ID: [redacted]
   • Secret Access Key: [redacted]

Step 6: Configure Permissions

1. Return to the IAM Console
2. Select the user your choice
3. Click the "Permissions" tab
4. "Add permissions" → "Attach policies directly"
5. Search for and attach: AmazonS3ReadOnlyAccess

Step 7: Successfully Listing the Bucket Contents

aws s3 ls s3://vnm-sec-aws/ --recursive

Key finding — two flag files turned up:

2022-12-13 23:00:41  39 a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/flag.txt
2022-11-18 21:09:28  81 a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/flag.txt

The flags are buried in extremely deep paths to prevent brute-force guessing!

Step 8: Download the Flag Files

Download the first flag:

aws s3 cp s3://vnm-sec-aws/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/flag.txt .
cat flag.txt
# Output: G?>L|:D4@?7:8FC650pFE96?E:42E650qF4<6EN

Download the second flag (which gives a hint about the first flag):

aws s3 cp s3://vnm-sec-aws/a/b/c/d/e/f/g/h/i/j/k/l/m/n/o/p/q/r/s/t/u/v/w/x/y/z/flag.txt flag2.txt
cat flag2.txt
# Output: Sorry! Please find flag in another folders. Use rot once you identify any string.

The second flag gives the hint: use ROT to decode the first one!

Step 9: Decode with ROT47

The encoded string contains special characters, so I figured it was ROT47:

echo "G?>L|:D4@?7:8FC650pFE96?E:42E650qF4<6EN" | tr '!-~' 'P-~!-O'

Or you can just use an online tool:

ROT-47 Cipher - ROT47 - Online Decoder, Encoder, Translator

Tool to decrypt/ encrypt with Rot47. The ROT-47 cipher is a variant of the ROT-13 suitable for ASCII characters, exactly a subset of 94 printable characters. Easily convert, test or analyze your encrypted texts online.

Online Decoder, Encoder, TranslatordCode

Final Flag: vnm{redacted}

Key Takeaways

The AWS S3 Permission Model

• AllUsers: anyone can access it (truly public)
• AuthenticatedUsers: anyone with an AWS account can access it
• Specific IAM users/roles: real access control

Conclusion

This CTF is a perfect demonstration of the most common AWS S3 misconfiguration: mistaking "Authenticated Users" for a secure setting. In the real world, many data breaches stem from exactly this kind of configuration error.