> For the complete documentation index, see [llms.txt](https://www.marialc.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.marialc.com/pentesterlab-labs/recon-badge/recon_25-s3.md).

# recon\_25 (S3)

View the exercise here: [PentesterLab: Recon 25](https://pentesterlab.com/exercises/recon_25/course)

### **OBJECTIVE**

For this challenge, your goal is to look at the server used to load assets (JavaScript, CSS) and find a file named **key2.txt**. However, this time you will need to be logged in to access it.

Amazon Web Services Storage Service (S3) allows file owners to set permissions on files. Historically, the rules "Any users" wasn't well explained and lead a lot of people to think only people in their Amazon account could access a file. However, this was allowing any AWS account to access the file.

### **WHY?**

It's essential to look for files that may be publicly available on the servers used to load assets.

### **SOLUTION**

`View Page Source` of hackycorp.com then open the links with assets on them

<figure><img src="/files/CwQF7jRlRc1ZHFR5iTlg" alt=""><figcaption></figcaption></figure>

Remove the `view-source:` prefix and retain the `http://assets.hackycorp.com`

<figure><img src="/files/hpO7ozQXj9uaGVTwBC1u" alt=""><figcaption></figcaption></figure>

We need to find a file called `key2.txt`, so we try to access the path `http://assets.hackycorp.com/key2.txt`

Access is denied for this path but from the objective, it was said that this file can be viewed by anyone with an AWS account.

<figure><img src="/files/aZkRhJGHVGj0sGMFNmrI" alt=""><figcaption></figcaption></figure>

So I created a temporary IAM user and produced access keys to be used in AWS CLI.

<figure><img src="/files/hbzwM7o56Vn03a0OUd2V" alt="" width="563"><figcaption></figcaption></figure>

Using **AWS CloudShell:**

Enter the line below to access AWS CLI:

```bash
aws configure
```

Type the `Access Key ID` & `Secret Access Key`

\**Region name & Output format may be left blank*

<figure><img src="/files/SYZNDn1hIsbs6vz3YVwH" alt="" width="563"><figcaption></figcaption></figure>

I tried `aws s3 cp s3://assets.hackycorp.com/key2.txt ~/` but this is forbidden.

<figure><img src="/files/NCck8H654fNbAUOR6CLE" alt="" width="563"><figcaption></figcaption></figure>

We need to set the permissions of the user first to view S3 buckets.

<figure><img src="/files/YeJSprwdICGNd9vZPCit" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="danger" %}
*This is not the best practice to set permissions but I’m just doing this for this exercise only.*
{% endhint %}

I tried listing the contents of assets.hackycorp.com...

```bash
aws s3 ls s3://assets.hackycorp.com
```

<figure><img src="/files/Mt6i6dVmrO9SIj88FHM2" alt="" width="563"><figcaption></figcaption></figure>

...and using the line below, but Access is still denied.

```bash
aws s3 ls s3://assets.hackycorp.com/key2.txt 
```

<figure><img src="/files/TxOPzT9NTO40F9jTLVVJ" alt="" width="563"><figcaption></figcaption></figure>

So I tried copying the contents of `assets.hackycorp.com/key2.txt` to the machine, and we were successful.

```sh
aws s3 cp s3://assets.hackycorp.com/key2.txt ~/
```

<figure><img src="/files/3k7TIPGWJa1DXHWSlEWb" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="success" %}
Opening the contents of **key2.txt**, we get the flag.
{% endhint %}

<figure><img src="/files/TwqdCzWoK5yDxtdv7B1R" alt="" width="563"><figcaption></figcaption></figure>

<figure><img src="/files/AKWtK765ypL3ISmsy8Z2" alt="" width="563"><figcaption></figcaption></figure>