Latest

Discovered a running webpage that allowed for registration. After logging in, it was revealed an outdated version of Camaleon CMS instance which was vulnerable to CVE-2024-46987 (Authenticated Arbitrary File Read). Leveraging that vulnerability to grab SSH keys on getting initial access. Finally, gained root access by exploiting a sudo misconfiguration using the facter command/binary.

The challenge provides JSON credentials that can be used to authenticate and enumerate GCP resources which includes IAM roles and service account emails that has admin permissions

The challenge provides Access Keys that are used to authenticate to the AWS instance and enumerate AWS IAM resources & Lambda function permissions. Leveraging those permissions, we can invoke a Lambda function to retrieve the hidden flag

The challenge provides Client Credentials that are used to identify the Tenant ID, then using that to request an Access Token that we can use to authenticate and enumerate the API Permission assigned to the Application

The challenge provides JSON credentials that can be used to brute-force IAM permissions to enumerate permissions on a service account