Cloudfoxable - Root

Thu, 12 Mar 2026 00:00:00 +0000

You’ve just gained access to the role Kent. Can you get to the root flag in the SSM parameter store?

Information Gathering

Short and concise challenge details, I will start by preparing a profile for ramos, and checking which policies are attached to it.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


adicpnn@laboratory cloud % cat ~/.aws/config| tail

[profile kent]
region = eu-central-1
role_arn = arn:aws:iam::129323993607:role/Kent
source_profile = cloudfoxable

adicpnn@laboratory cloud % aws iam list-attached-role-policies --role-name Kent --profile cloudfoxable
{
 "AttachedPolicies": [
 {
 "PolicyName": "root-policy1",
 "PolicyArn": "arn:aws:iam::129323993607:policy/root-policy1"
 }
 ]
}

A single policy attached, let’s see what type of access it grants.

Ssm on security ?!

Cloudfoxable - Root

Information Gathering