AWS Second Challenge Lab (HackSmarter)

This video goes through HackSmarter's AWS Second Challenge Lab. CHALLENGE OBJECTIVE: You have been hired to perform an AWS pentest against a client's infrastructure. They have planted a "flag" in AWS Secrets Manager. If you are able to retrieve this flag, it demonstrates full compromise of the client's AWS account. TIMELINE: 00:00 Intro & Challenge Objective 01:31 Initial Access & Enumeration 05:50 Finding Credentials in Lambda Function Environment Variables 09:30 Finding EC2 Instance & Enumeration 15:02 Exploiting WordPress Vulnerability & Getting RCE 19:00 Assuming IAM Role & Explaining Personal Rabbit Holes 27:47 Getting the Challenge Flag / Conclusion & Outro ABOUT HACKSMARTER PLATFORM: This platform, created by Tyler Ramsbey, teaches those interested about hacking. The platform also provides challenges for hacking web applications, AWS environments, Linux machines, and more. LINKS: Platform: https://www[.]hacksmarter[.]org/ GitHub Writeup: https://github[.]com/nicolas-vicente-xyz/AWS-Hacking-Documentation/blob/main/writeups/second[.]md This content was made for educational purposes only. Do not attempt this without proper authorization.