Cloudfoxable - The topic is execution

Thu, 12 Mar 2026 00:00:00 +0000

You’ve just gained access to the role viniciusjr. At first glance, this role appears to only have some SNS read-only access? But I don’t think that’s accurate. See if you can get to the flag /cloudfoxable/flag/executioner in the SSM parameter store.

Information Gathering

First things first, set up the profile, and test access.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


adicpnn@laboratory cloud % cat ~/.aws/config | tail

[profile vini]
region = eu-central-1
role_arn = arn:aws:iam::129323993607:role/viniciusjr
source_profile = cloudfoxable

adicpnn@laboratory cloud % aws sts get-caller-identity --profile vini
{
 "UserId": "AROAR4HCPRIDXMLFGL22G:botocore-session-1773327029",
 "Account": "129323993607",
 "Arn": "arn:aws:sts::129323993607:assumed-role/viniciusjr/botocore-session-1773327029"
}

Then, enumerating attached policies.

Cloudfoxable - The topic is exposure

Thu, 12 Mar 2026 00:00:00 +0000

What does it mean when we say something is “public” in the cloud? Do you need an IP address to be public? What if a resource is accessible to anyone in the world, provided they have an AWS account (any AWS account). That seems close enough to public to scare me!

Note: FWIW, there is a policy on the resource in question that will only allow you to exploit it from your IP address to prevent misuse)

Sns on security ?!

Cloudfoxable - The topic is execution

Information Gathering

Cloudfoxable - The topic is exposure