Scenario: ec2_ssrf
Deployment:
git clone https://github.com/RhinoSecurityLabs/cloudgoat.git
cd cloudgoat
chmod +x cloudgoat.py
./cloudgoat.py create ec2_ssrf
~/.aws/credentials
Add then add secrets to “/root/.aws/credentials” file with profile name “solus”
Scenario Resources
- 1 VPC with:
- EC2 x 1
- 1 Lambda Function
- 1 S3 Bucket
Scenario Start(s)
- IAM User “Solus”
Scenario Goal(s)
Invoke the “cg-lambda-[ CloudGoat ID ]” Lambda function.
Summary
Starting as the IAM user Solus, the attacker discovers they have ReadOnly permissions to a Lambda function, where hardcoded secrets lead them to an EC2 instance running a web application that is vulnerable to server-side request forgery (SSRF). After exploiting the vulnerable app and acquiring keys from the EC2 metadata service, the attacker gains access to a private S3 bucket with a set of keys that allow them to invoke the Lambda function and complete the scenario.
