Cloudfoxable - Trust me

Tue, 17 Mar 2026 00:00:00 +0000

There’s a role that trusts the repo you just created. Find the role and exploit the trust to access the flag.

Information Gathering

I’ll start off by enumerating AWS roles in my sandbox account, hoping to see a trust policy for the repo i’ve created adicpnn/cfx_trust_me.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


adicpnn@laboratory aws % aws iam list-roles --profile cloudfoxable
...
{
 "Path": "/",
 "RoleName": "t_rodman",
 "RoleId": "AROAR4HCPRIDWZYYOATJQ",
 "Arn": "arn:aws:iam::129323993607:role/t_rodman",
 "CreateDate": "2026-03-17T15:21:22+00:00",
 "AssumeRolePolicyDocument": {
 "Version": "2012-10-17",
 "Statement": [
 {
 "Sid": "",
 "Effect": "Allow",
 "Principal": {
 "Federated": "arn:aws:iam::129323993607:oidc-provider/token.actions.githubusercontent.com"
 },
 "Action": "sts:AssumeRoleWithWebIdentity",
 "Condition": {
 "StringLike": {
 "token.actions.githubusercontent.com:sub": "repo:adicpnn/cfx_trust_me:*",
 "token.actions.githubusercontent.com:aud": "sts.amazonaws.com"
 }
 }
 }
 ]
 },
 "MaxSessionDuration": 3600
 }
...

What this trust policy statement allows, is for GitHub Actions to assume the role t_rodman using OpenID Connect. I’ll keep this information and mind, and keep unraveling the exploit chain.

Github-Actions on security ?!

Cloudfoxable - Trust me

Information Gathering