Cloudgoat Beanstalk_Secrets Walkthrou

Thu, 21 Aug 2025 00:00:00 +0000

Initial Access / Credentials

initial_low_priv_credentials = Access Key: AKIA[REDACTED-CTF]
Secret Key: [REDACTED-CTF]

AWC CLI profile creation

aws configure --profile low_priv
AWS Access Key ID [None]: AKIA[REDACTED-CTF]
AWS Secret Access Key [None]: [REDACTED-CTF]
Default region name [None]: us-east-1
Default output format [None]: json

Created an aws profile with the credentials given

Enumeration with `low_priv` credentials

whoami

└─$ aws sts get-caller-identity --profile low_priv 
{
 "UserId": "AIDAUGVOUJQINCWVIJQHB",
 "Account": "289202785296",
 "Arn": "arn:aws:iam::289202785296:user/cgid9oc3krm0fl_low_priv_user"
}

Gives us the username

IAM Enumeration with pacu (What Privileges do our user have?)

Pacu (low_priv:imported-low_priv) > run iam__bruteforce_permissions --region us-east-1

Used the iam_bruteforce_permissions module from pacu

Hacking Blog

Cloudgoat Beanstalk_Secrets Walkthrou

Initial Access / Credentials

AWC CLI profile creation

Enumeration with low_priv credentials

IAM Enumeration with pacu (What Privileges do our user have?)

Enumeration with `low_priv` credentials