Taking Over an AWS Account with SSRF! (ec2_ssrf)

Join the Hack Smarter community: hacksmarter.org
--- In this video, we work our way through the "ec2_ssrf" scenario on CloudGoat.
Specifically, I cover the following:
- Enumerating Lambda Functions for secrets
- Enumerating EC2 instances for public web server
- Abusing an SSRF vulnerability in a web server to read AWS metadata
- Searching for sensitive information in S3 buckets
- Fully compromising the environment by stealing credentials of the admin user
Enjoy!
--------------
Introduction to CloudGoat - Full Workshop: • Launch Your First Clou...
Rhino Security Labs Discord: / discord
Work Smarter Discord: / discord
Twitch: hacksmarter.live/

[@rogerhuang4205]

I like the part where u fix and troubleshoot live! Good content and learning, keep it up!

[@sitandstand5469]

Whats the point after get elliot running lambda function? I thought solus as non prevs user will run it

[@TylerRamsbey]

Actually, Solus had read access to the function, but could not actually execute it. After Elliot can run the function, privilege escalation would be performed from that point on. This scenario doesn't have anything else built into it -- outside of the scenario goal of running the function :)