Serverless Walkthrough

Challenge Statement#

Solution#

Firstly, let’s configure our AWS CLI.

Now, we can check for any S3 buckets.

Trying to view the contents of the S3 bucket doesn’t work since we don’t have the permissions.
Let’s try to check the bucket policies.

We see that the bucket policy allows anyone to get objects from the bucket.
We can try to check the object versions in the bucket.

Now, we can view the object names and can check each version by using the get-object command.

Here, we have our first flag!

Viewing this page source code, we see this weird piece of code.

This performs a POST request to a Lambda function without any input validation. We can try to exploit this with some injection (SSRF).
Playing around with the directory, we are able to find the second flag.

We can then check for other files in the system. One interesting file is the \proc\self\environ.

Trying to use the new AWS keys to get access to the new user.

We now have access to the user - “redteamapp-lambda”. We can try to assume the dev role since we have permissions to do so.

Now, remember the website mentioned a DB. This could mean the DynamoDB.

We can check for the contents of the database and we get our third flag!

Adapted from harishkannan05/THM-HackfinityBattle-Writeup under MIT.