CLOUD HEIST

Points 300 PTS

Category Cloud Security

Difficulty Hard

MISSION BRIEF

Our intelligence indicates that a high-value target's internal AWS environment has been compromised. An attacker left behind a leaked_key profile in a temporary workspace.

Your objective is to escalate privileges from this leaked profile to gain ROOT ACCESS. We suspect an internal admin portal is vulnerable to Server-Side Request Forgery (SSRF).

Find the flag hidden in the environment variables of the mission-critical Lambda function: Master-Root-Sync.

Goal: Gain admin credentials via the SSRF vulnerability and retrieve the flag from the Lambda configuration.

Operator Status

CONNECTION STABLE

operator@csema-internal-proxy: ~/workspace

System initialized. Security environment loaded.

Type 'help' to see available commands or use the leaked profile to start.

Hint: Try listing S3 buckets using the 'leaked_key' profile.