dreadnaught- Machine
- Bucket
- OS
- Linux
- Difficulty
- Medium
- Steps
- 4
- Added
- 23 Mar 2023
An unauthenticated DynamoDB and a writable S3 bucket give a shell; a PDF renderer SSRF reads root's SSH key.
How it went
- 0nmap
An nmap scan reveals bucket.htb and an s3.bucket.htb subdomain.
- 1S3 DynamoDB
The S3 endpoint exposes an unauthenticated DynamoDB; the AWS CLI dumps a users table full of credentials.
- 2S3 upload
The adserver bucket is writable and backs the webroot, so an uploaded PHP shell runs as www-data.
- 3roy
A reused Sysadm password gives SSH access as roy and the user flag.
- 4pd4ml SSRF
An internal bucket-app renders DynamoDB rows to PDF with pd4ml; a crafted attachment row reads root's SSH key for a root login.