Hack The Box-Sherlocks-Nubilum-2

靶场介绍

Leading telecoms provider Forela uses AWS S3 as an essential part of their infrastructure. They can deploy applications quickly and do effective analytics on their sizable dataset thanks to it acting as both an application storage and a data lake storage. Recently, a user reported an urgent issue to the helpdesk: an inability to access files within a designated S3 directory. This disruption has not only impeded critical operations but has also raised immediate security concerns. The urgency of this situation demands a security-focused approach. Reports of a misconfigured S3 Bucket policy for the forela-fileshare bucket, resulting in unintended public access, highlight a potential security vulnerability that calls for immediate corrective measures. Consequently, a thorough investigation is paramount.

领先的电信提供商Forela将AWS S3作为其基础设施的重要组成部分。他们可以快速部署应用程序，并在其庞大的数据集上进行有效的分析，这要归功于它既是应用程序存储又是数据湖存储。最近，一位用户向服务台报告了一个紧急问题：无法访问指定S3目录中的文件。这种干扰不仅阻碍了关键行动，而且引发了紧迫的安全问题。这种局势的紧迫性要求采取以安全为重点的办法。有关forera文件共享存储桶的S3存储桶策略配置错误，导致意外的公共访问的报告突出显示了一个潜在的安全漏洞，需要立即采取纠正措施。因此，彻底调查至关重要。

Task 1

What was the originating IP address the Threat Actor (TA) used to infiltrate the Forela’s AWS account?

威胁参与者（TA）用于渗透Forela的AWS帐户的原始IP地址是什么？

Task 2

What was the time, filename, and Account ID of the first recorded s3 object accessed by the TA?

TA访问的第一个记录的s3对象的时间、文件名和帐户ID是多少？

Task 3

How many Access Keys were compromised, at a minimum?

至少有多少访问密钥被泄露？

Task 4

The TA executed a command to filter EC2 instances. What were the name and value used for filtering?

TA执行了一个命令来过滤EC2实例。用于筛选的名称和值是什么？

Task 5

Can you provide the count of unsuccessful discovery and privilege escalation attempts made by the TA before gaining elevated access with the compromised keys?

您能否提供TA在使用受损密钥获得提升访问权限之前进行的不成功发现和权限提升尝试的计数？

Task 6

Which IAM user successfully gained elevated privileges in this incident?

哪个IAM用户在此事件中成功获得提升的权限？

Task 7

Which event name permitted the threat actor to generate an admin-level policy?

哪个事件名称允许威胁参与者生成管理员级别的策略？

Task 8

What is the name and statement of the policy that was created that gave a standard user account elevated privileges?

为标准用户帐户提供提升权限的策略的名称和声明是什么？

Task 9

What was the ARN (Amazon Resource Name) used to encrypt the files?

用于加密文件的ARN（亚马逊资源名称）是什么？

Task 10

What was the name of the file that the TA uploaded to the S3 bucket?

TA上传到S3 bucket的文件的名称是什么？

Task 11

Which IAM user account did the TA modify in order to gain additional persistent access?

TA修改了哪个IAM用户帐户以获得额外的持久访问权限？

Task 12

What action was the user not authorized to perform to view or download the file in the S3 bucket?

用户无权执行什么操作来查看或下载S3存储桶中的文件？