[LAB] [CTF] iam:CreateAccessKey PrivEsc

Scenario 🧪

Only high level admins should have the iam:CreateAccessKey permission, because an attacker with the iam:CreateAccessKey permission on other users can create an access key ID and secret access key for that user, which means they can authenticate as that user.

Exploit this lab’s misconfigured IAM policy to elevate your privileges. You’ve successfully completed this lab once you’ve accessed and downloaded sensitive files containing customer PII in Amazon S3 and you’ve submitted the credit card number for “Kayla Sanchez” from the customers.txt file.

Steps

• Using the provided Access Key ID and Secret Access Key, configure your AWS CLI profile
• Using the AWS CLI, identify what permissions your current user has access to and perform general reconnaissance to familiarize yourself with the AWS environment
• Gain access to and authenticate as the IAM user ending in -Victim
• Using your new permissions, access the S3 bucket containing sensitive data
• Download those files and make sure they contain PII.
• Submit the flag by copy/pasting the credit card number for “Kayla Sanchez”