Cloudfoxable - Root

You’ve just gained access to the role Kent. Can you get to the root flag in the SSM parameter store? Information Gathering Short and concise challenge details, I will start by preparing a profile for ramos, and checking which policies are attached to it. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 adicpnn@laboratory cloud % cat ~/.aws/config| tail [profile kent] region = eu-central-1 role_arn = arn:aws:iam::129323993607:role/Kent source_profile = cloudfoxable adicpnn@laboratory cloud % aws iam list-attached-role-policies --role-name Kent --profile cloudfoxable { "AttachedPolicies": [ { "PolicyName": "root-policy1", "PolicyArn": "arn:aws:iam::129323993607:policy/root-policy1" } ] } A single policy attached, let’s see what type of access it grants. ...

March 12, 2026 · 6 min · 1231 words