Upon visiting the URL, the API Gateway rendered the text "Welcome to TetCTF!"
Based on my previous experience in solving similar CTF, I assumed that its API Gateway calling a Lambda Function, and that I need to perform RCE. I tried out different template injection via fuzzing and realize that its just a simple calculator, and 7*7 works.
The error message also suggest that it is running some form of JavaScript
Using a RCE payload, I am able to leak the source code as well as the environment variable.
Now that we have the AWS Credentials, we can pivot to the cloud portion of the challenge.
First, I tried enumerating with AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN; however, it quickly proved itself to be a red herring as there are no permissions configured.
I looked at the environment variable again, and reliaze there is an extra set of key being saved in environment variable, namely ENV_ACCESS_KEY and ENV_SECRET_ACCESS_KEY.
Next, I performed manual enumeration but couldnt get any results as the user does not have much permission.
I was stuck here for a while, and decided to use enumerate-iam to help perform the enumeration. (ps i also used enumerate-iam for the previous part). Immediately, some interesting permission pop out.
Hindsight is 20/20, of course the secret-user will have permission on secretsmanager 🤦♂️
I am then able to just retrieve the flag from the secretsmanager.