Hands-on lab
IAM UpdateLoginProfile PrivEsc
Exploit iam:UpdateLoginProfile to get access to an Amazon S3 bucket containing sensitive data that your IAM user should not have been able to access. This is very similar to iam:CreateLoginProfile with the only difference being the command that you issue. However, to make this lab more interesting, we've increased the difficulty just a little bit. The flag is the credit card number for "Joshua Lee" from the exfiltrated customers file.
Comments
Loading comments…