search

Hello from API GW

hashtag
Description:

Author:

  • Chi Tran (Twitter: @imspicynoodles) (Discord: iam.chi)

Material:

  • AWS Account is not needed for this challenge

hashtag
Hacking The API

Given API url seems to reflect on what we give, giving it string gives back a string.

└─$ URL='https://huk5xbypcc.execute-api.ap-southeast-2.amazonaws.com/dev/vulnerable'

└─$ curl "$URL?vulnerable=Welcome"   # Not String
{"error":"Welcome is not defined"}                   
     
└─$ curl "$URL?vulnerable='Welcome'" # String
{"message":"Evaluated User Input","result":"Welcome"}      

└─$ curl "$URL?vulnerable='2-1'"     # String - String
{"message":"Evaluated User Input","result":"2-1"}        

└─$ curl "$URL?vulnerable=2-1"       # Int - Int
{"message":"Evaluated User Input","result":1}

From this few requests we see that some kind of evaluation is done with our input. My first thought was a python script, but then I tried JavaScript code and it worked.

Exploit the service:

chevron-rightindex.jshashtag

Interesting variables:

hashtag
Hacking The Cloud

circle-info

For this step awscliarrow-up-right is required.

First we need to register the credentials. Here I first tried the ENV_* variables:

Since this was my first time interacting with cloud I just refered to HackTricksarrow-up-right. Do simple enum:

User: arn:aws:iam::543303393859:user/secret-user seems promising.

Using enumerate-iamarrow-up-right check what permissions you have in the cloud.

secretsmanagerarrow-up-right seems interesting...

hashtag
Flag

circle-check

Flag: TetCTF{B0unTy_$$$-50_for_B3ginNeR_2a3287f970cd8837b91f4f7472c5541a}

PreviousTetCTFNextUSCyberGames

Last updated