Cloudy with a Chance of Breach

An incident response challenge on a compromised monitoring server. An attacker hit a command injection bug in a Flask app, gained root, and left AWS credentials behind. Recovering those creds gives access to a private S3 bucket holding the flag.

Solve

1. Read the monitoring app at /opt/netmon/app.py and find the command injection in the lookup function (raw input passed to nslookup with shell=True).
2. Review ~/.bash_history and /etc/cron.d/netmon-backup to learn that logs sync to an S3 bucket named meridian-netmon-logs.
3. Find the leaked AWS credentials the attacker dropped in /tmp/creds_bkp_4e8f21.txt.
4. Configure the environment with the discovered credentials:

   export AWS_ACCESS_KEY_ID="AKIAZPCYMLDLEN2D7AWH"
   export AWS_SECRET_ACCESS_KEY="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"
   export AWS_DEFAULT_REGION="us-east-1"
   

5. List the bucket directly to work around restricted permissions:

   aws s3 ls s3://meridian-netmon-logs/
   

6. Download and read the flag:

   aws s3 cp s3://meridian-netmon-logs/flag.txt -
   

Flag: SVIUSCG{l00ks_4_l1ttl3_cl0udy}