HG Logo

Asso' HackGyver 2.0

HTB Cyber Apocalypse 2026 CTF: Empty Chairs

Écrit par l’équipe HackGyver – 24 août 2026

Table des matières

Intro

Elowen Ashglass arrive à l'un des postes de surveillance routiers de Sythra après que le signal matinal n'a pas été donné. Le foyer est encore chaud, des lances sont appuyées contre la porte, et les éclaireurs ont disparu. Des cendres rouges sous les seuils et des traces de pas par paires sur la route indiquent que les Aides Silencieux les ont emmenés vivants. Sans ce poste, Stormbound perd de vue la route qui s'étend devant lui. Elowen doit suivre les traces, retrouver les éclaireurs disparus et découvrir où les Aides les emmènent avant que le givre ne recouvre les traces. 18 flags à trouver :

1. What is the source IP on the last ReceiveMessage before a non-internal IP performs ReceiveMessage on that same queue?
2. From which external IP did the contractor perform the full scout diversion attack (including PurgeQueue)?
3. On the live diversion source IP, which secret name returned AccessDenied on the first denied GetSecretValue call?
4. Which secret name was successfully read before the role assumption?
5. Which IAM role name did the attacker fail to assume before the successful pivot? (role name only, not ARN)
6. Which IAM role ARN was successfully assumed to control watchpost routing?
7. What roleSessionName was used on the successful AssumeRole?
8. What IAM identity type does CloudTrail record for API calls made after the successful role pivot?
9. What is the SQS queue name targeted for the fraudulent scout recall order?
10. What order_id value was injected in the fraudulent scout recall order?
11. What route_override destination did the attacker set in the fraudulent order?
12. What KMS keyId did the attacker use when decrypting the routing envelope after SendMessage?
13. What SNS topic name received the diversion alert Publish call?
14. What DynamoDB table name received the forged ledger PutItem?
15. What is the S3 access log operation field for the GetObject on signed-routing-bundle.json from the external IP?
16. What is the name of the CloudTrail trail the attacker verified before purging queue evidence?
17. Which API action destroyed the queue evidence at the end of the attack chain?
18. Which IAM user name owned the long-lived access key used to start the attack chain?

Intro d'analyse

La commande

aws cloudtrail lookup-events --max-items 10 > retour.txt

Ne donne pas grand chose, donc on va prendre un peu plus large (300 items) en enregistrant en JSON. PS : En dessous (200 items), on trouvait peu d'adresses IP

Liste les adresses IP source :

jq -r '.Events[].CloudTrailEvent | fromjson | .sourceIPAddress' retour.json | uniq
10.23.87.41
127.0.0.1
198.51.100.22
203.0.113.17
203.0.113.41
203.0.113.88
92.184.124.105
s3.amazonaws.com

Flag 1

What is the source IP on the last ReceiveMessage before a non-internal IP performs ReceiveMessage on that same queue ? On filtre tous les événements contenant ReceiveMessage :

jq -r '.Events[] | select(.EventName=="ReceiveMessage")' retour.json
{
  "EventId": "0a0c2408-155b-453b-b2b9-5fe48482e453",
  "EventName": "ReceiveMessage",
  "ReadOnly": "true",
  "EventTime": "2026-07-27T13:25:15.783000+02:00",
  "EventSource": "sqs.amazonaws.com",
  "Resources": [
    {
      "ResourceType": "AWS::SQS::Queue",
      "ResourceName": "arn:aws:sqs:us-east-1:719384620571:eastreach-scout-recall-pending"
    }
  ],
  "CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"AssumedRole\",\"sessionContext\":{\"sessionIssuer\":{\"type\":\"Role\",\"principalId\":\"AROA719384620571eastreach-dispatch-role\",\"arn\":\"arn:aws:iam::719384620571:role/eastreach-dispatch-role\",\"accountId\":\"719384620571\",\"userName\":\"eastreach-dispatch-role\"},\"attributes\":{\"creationDate\":\"2026-07-27T11:25:15.783Z\",\"mfaAuthenticated\":\"false\"}},\"principalId\":\"AROA3351AZA3GT4J4K96:dispatch-runner\",\"arn\":\"arn:aws:sts::719384620571:assumed-role/eastreach-dispatch-role/dispatch-runner\",\"accountId\":\"719384620571\",\"accessKeyId\":\"ASIA8ZLJQMTY7TB9XNM4\"},\"eventTime\":\"2026-07-27T11:25:15.783Z\",\"eventSource\":\"sqs.amazonaws.com\",\"eventName\":\"ReceiveMessage\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"203.0.113.88\",\"userAgent\":\"Boto3/1.29.7 md/Botocore#1.29.7 ua/2.0 os/linux#5.15.0-107-generic md/arch#x86_64 lang/python#3.10.12 md/pyimpl#CPython cfg/retry-mode#standard Botocore/1.29.7\",\"additionalEventData\":{\"SignatureVersion\":\"AWS4-HMAC-SHA256\",\"AuthenticationMethod\":\"AuthHeader\"},\"requestParameters\":{\"path\":\"/\",\"queueUrl\":\"https://sqs.us-east-1.amazonaws.com/719384620571/eastreach-scout-recall-pending\"},\"responseElements\":null,\"requestID\":\"4164000a-9a53-48f1-bb11-57f3a7413782\",\"eventID\":\"0a0c2408-155b-453b-b2b9-5fe48482e453\",\"readOnly\":true,\"eventType\":\"AwsApiCall\",\"managementEvent\":false,\"eventCategory\":\"Data\",\"recipientAccountId\":\"719384620571\",\"resources\":[{\"ARN\":\"arn:aws:sqs:us-east-1:719384620571:eastreach-scout-recall-pending\",\"type\":\"AWS::SQS::Queue\",\"accountId\":\"719384620571\"}]}"
}
{
  "EventId": "f7a16b6c-7f7b-4e09-a72f-8e846b1bc72a",
  "EventName": "ReceiveMessage",
  "ReadOnly": "true",
  "EventTime": "2026-07-27T13:25:02.863000+02:00",
  "EventSource": "sqs.amazonaws.com",
  "Username": "eastreach-dispatcher",
  "Resources": [
    {
      "ResourceType": "AWS::SQS::Queue",
      "ResourceName": "arn:aws:sqs:us-east-1:719384620571:eastreach-scout-recall-pending"
    }
  ],
  "CloudTrailEvent": "{\"eventVersion\":\"1.11\",\"userIdentity\":{\"type\":\"IAMUser\",\"principalId\":\"AIDAISJJ74LW\",\"arn\":\"arn:aws:iam::719384620571:user/eastreach-dispatcher\",\"accountId\":\"719384620571\",\"accessKeyId\":\"AKIARFOB5HNUISJJ74LW\",\"userName\":\"eastreach-dispatcher\"},\"eventTime\":\"2026-07-27T11:25:02.863Z\",\"eventSource\":\"sqs.amazonaws.com\",\"eventName\":\"ReceiveMessage\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"10.23.87.41\",\"userAgent\":\"Boto3/1.34.0 md/Botocore#1.34.0 ua/2.0 os/linux#5.15.167.4-lts-hwe lang/python#3.11.9 cfg/retry-mode#standard exec-env/EC2 dispatch-console/2.1\",\"requestParameters\":{\"queueUrl\":\"https://sqs.us-east-1.amazonaws.com/719384620571/eastreach-scout-recall-pending\",\"maxNumberOfMessages\":1,\"visibilityTimeout\":30},\"responseElements\":null,\"readOnly\":true,\"eventType\":\"AwsApiCall\",\"managementEvent\":false,\"recipientAccountId\":\"719384620571\",\"eventID\":\"f7a16b6c-7f7b-4e09-a72f-8e846b1bc72a\",\"resources\":[{\"ARN\":\"arn:aws:sqs:us-east-1:719384620571:eastreach-scout-recall-pending\",\"type\":\"AWS::SQS::Queue\"}]}"
}

Ensuite, on recherche les 2 IP avec le timestamp :

jq -r '.Events[] | select(.EventName=="ReceiveMessage") | .CloudTrailEvent | fromjson | [.eventTime, .sourceIPAddress] | @tsv' retour.json
2026-07-27T11:25:15.783Z	203.0.113.88
2026-07-27T11:25:02.863Z	10.23.87.41

L'IP source qui a fait l'action avant l'IP de l'attaquant est 10.23.87.41 Flag 1 : 10.23.87.41

Recherche de Flag

Flag 2

From which external IP did the contractor perform the full scout diversion attack (including PurgeQueue) ?

jq -r '.Events[] | select(.EventName=="PurgeQueue") | .CloudTrailEvent | fromjson | [.sourceIPAddress] | @tsv' retour.json
203.0.113.88

Flag 2 : 203.0.113.88

Flag 3

On the live diversion source IP, which secret name returned AccessDenied on the first denied GetSecretValue call?

jq -r '.Events[] | select(.EventName=="GetSecretValue") | .CloudTrailEvent | fromjson | select(.sourceIPAddress=="203.0.113.88" and .errorCode=="AccessDeniedException")| [.eventTime, .requestParameters.secretId] | @tsv'
2026-07-27T11:25:11.311Z	eastreach/depot-routing/manifest
2026-07-27T11:25:10.727Z	eastreach/patrol-ledger-token
2026-07-27T11:25:10.718Z	eastreach/dispatch-signing-draft

Flag 3 : eastreach/dispatch-signing-draft

Flag 4

Which secret name was successfully read before the role assumption ? Double requête :

jq -r '.Events[] | select(.EventName=="AssumeRole") | .CloudTrailEvent | fromjson | [.eventTime, .sourceIPAddress] | @tsv' retour.json
2026-07-27T11:25:13.468Z	203.0.113.88
2026-07-27T11:25:12.867Z	203.0.113.88

On recherche tous les événements "AssumeRole" et on les compare avec ceux de "GetSecretValue"

jq -r '.Events[] | select(.EventName=="GetSecretValue") | .CloudTrailEvent | fromjson | select(.eventTime>="2026-07-27T11:25:11:999Z") | [.eventTime, .requestParameters.secretId] | @tsv' retour.json
2026-07-27T11:25:12.062Z	eastreach/dispatch-signing

Flag 4 : eastreach/dispatch-signing

Flag 5

Which IAM role name did the attacker fail to assume before the successful pivot? (role name only, not ARN)

jq -r '.Events[] | select(.EventName=="AssumeRole") | .CloudTrailEvent | fromjson | select(.errorCode=="AccessDenied")| .requestParameters.roleArn' retour.json
arn:aws:iam::719384620571:role/eastreach-archive-reader

Flag 5 : eastreach-archive-reader

Flag 6

Which IAM role ARN was successfully assumed to control watchpost routing ?

jq -r '.Events[] | select(.EventName=="AssumeRole") | .CloudTrailEvent | fromjson | [.requestParameters.roleArn, .errorCode] | @tsv' retour.json
arn:aws:iam::719384620571:role/eastreach-dispatch-role	
arn:aws:iam::719384620571:role/eastreach-archive-reader	AccessDenied

Flag 6 : eastreach-dispatch-role

Flag 7

What roleSessionName was used on the successful AssumeRole ?

jq -r '.Events[] | select(.EventName=="AssumeRole") | .CloudTrailEvent | fromjson | [.requestParameters.roleArn, .errorCode, .requestParameters.roleSessionName] | @tsv' retour.json
arn:aws:iam::719384620571:role/eastreach-dispatch-role		dispatch-runner
arn:aws:iam::719384620571:role/eastreach-archive-reader	AccessDenied	archive-reader-probe

Flag 7 : dispatch-runner

Flag 8

What IAM identity type does CloudTrail record for API calls made after the successful role pivot ?

jq -r '.Events[] | .CloudTrailEvent | fromjson | select(.eventTime > "2026-07-27T11:25:13.468Z") | [.eventTime, .eventName, .userIdentity.type] | @tsv' retour.json
2026-07-27T11:25:22.169Z	PurgeQueue	AssumedRole
2026-07-27T11:25:21.403Z	GetTrailStatus	AssumedRole
2026-07-27T11:25:19.387Z	GetObject	AssumedRole
2026-07-27T11:25:19.386Z	PutObject	AWSService
2026-07-27T11:25:18.743Z	ListObjectsV2	AssumedRole
2026-07-27T11:25:18.742Z	PutObject	AWSService
2026-07-27T11:25:17.938Z	PutItem	AssumedRole
2026-07-27T11:25:17.537Z	Publish	AssumedRole
2026-07-27T11:25:17.144Z	Decrypt	AssumedRole
2026-07-27T11:25:16.576Z	SendMessage	AssumedRole
2026-07-27T11:25:15.783Z	ReceiveMessage	AssumedRole
2026-07-27T11:25:14.989Z	GetQueueAttributes	AssumedRole
2026-07-27T11:25:14.421Z	GetCallerIdentity	AssumedRole

Flag 8 : AssumedRole

Flag 9 :

What is the SQS queue name targeted for the fraudulent scout recall order ? SQS = Simple Queue Service En se basant sur la source : jq -r '.Events[] | select(.EventSource=="sqs.amazonaws.com")' retour.json

jq -r '.Events[] | select(.EventSource=="sqs.amazonaws.com" and .EventName=="SendMessage") | .CloudTrailEvent | fromjson | .requestParameters.queueUrl' retour.json
https://sqs.us-east-1.amazonaws.com/719384620571/eastreach-scout-recall-pending

Flag 9 : eastreach-scout-recall-pending

Flag 10

What order_id value was injected in the fraudulent scout recall order?

jq -r '.Events[] | select(.EventSource=="sqs.amazonaws.com" and .EventName=="SendMessage") | .CloudTrailEvent | fromjson | .requestParameters.messageBody' retour.json
{"order_id": "ER-DIV-9941", "route_override": "quietmarch-depot-11/bypass-C", "authorized_by": "dispatch-runner", "priority": "URGENT"}

Flag 10 : ER-DIV-9941

Flag 11

What route_override destination did the attacker set in the fraudulent order ?

Même commande que Flag 10

Flag 11 : quietmarch-depot-11/bypass-C

Flag 12

What KMS keyId did the attacker use when decrypting the routing envelope after SendMessage ? KMS = Key Management Service

jq -r '.Events[] | select(.EventSource=="kms.amazonaws.com") | .CloudTrailEvent | fromjson | .requestParameters.keyId' retour.json
arn:aws:kms:us-east-1:719384620571:alias/eastreach/watchpost-routing-key

Flag 12 : arn:aws:kms:us-east-1:719384620571:alias/eastreach/watchpost-routing-key

Flag 13

What SNS topic name received the diversion alert Publish call ?

jq -r '.Events[] | select(.EventSource=="sns.amazonaws.com")' retour.json 
{
  "EventId": "d1edfb60-0e1b-474c-9662-641c15b161e1",
  "EventName": "Publish",
  "ReadOnly": "false",
  "EventTime": "2026-07-27T13:25:17.537000+02:00",
  "EventSource": "sns.amazonaws.com",
  "Resources": [
    {
      "ResourceType": "AWS::SNS::Topic",
      "ResourceName": "arn:aws:sns:us-east-1:719384620571:eastreach-diversion-alerts"
    }
  ],

Flag 13 : eastreach-diversion-alerts

Flag 14

What DynamoDB table name received the forged ledger PutItem ?

jq -r '.Events[] | select(.EventName=="PutItem")| .Resources[0].ResourceName' retour.json
arn:aws:dynamodb:us-east-1:719384620571:table/eastreach-watchpost-ledger

Flag 14 : eastreach-watchpost-ledger

Flag 15

What is the S3 access log operation field for the GetObject on signed-routing-bundle.json from the external IP ? La recherche se fait avec l'aide de CloudTrail et le flag se trouve dans les logs S3 On cherche déjà les événements GetObject et on garde que ce qui nous intéresse signed-routing-bundle.json :

jq -r '.Events[] | select(.EventName=="GetObject") ' retour.json
{
  "EventId": "2c867f0f-a0f3-468c-8f02-4846e452aa3b",
  "EventName": "GetObject",
  "ReadOnly": "true",
  "EventTime": "2026-07-27T13:25:19.387000+02:00",
  "EventSource": "s3.amazonaws.com",
  "Resources": [
    {
      "ResourceType": "AWS::S3::Object",
      "ResourceName": "arn:aws:s3:::eastreach-watchpost-manifests/signed-routing-bundle.json"
    },
    {
      "ResourceType": "AWS::S3::Bucket",
      "ResourceName": "arn:aws:s3:::eastreach-watchpost-manifests"
    }
  ],
  "CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"AssumedRole\",\"sessionContext\":{\"sessionIssuer\":{\"type\":\"Role\",\"principalId\":\"AROA719384620571eastreach-dispatch-role\",\"arn\":\"arn:aws:iam::719384620571:role/eastreach-dispatch-role\",\"accountId\":\"719384620571\",\"userName\":\"eastreach-dispatch-role\"},\"attributes\":{\"creationDate\":\"2026-07-27T11:25:19.382Z\",\"mfaAuthenticated\":\"false\"}},\"principalId\":\"AROA3351AZA3GT4J4K96:dispatch-runner\",\"arn\":\"arn:aws:sts::719384620571:assumed-role/eastreach-dispatch-role/dispatch-runner\",\"accountId\":\"719384620571\",\"accessKeyId\":\"ASIA8ZLJQMTY7TB9XNM4\"},\"eventTime\":\"2026-07-27T11:25:19.387Z\",\"eventSource\":\"s3.amazonaws.com\",\"eventName\":\"GetObject\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"203.0.113.88\",\"userAgent\":\"Boto3/1.29.7 md/Botocore#1.29.7 ua/2.0 os/linux#5.15.0-107-generic md/arch#x86_64 lang/python#3.10.12 md/pyimpl#CPython cfg/retry-mode#standard Botocore/1.29.7\",\"additionalEventData\":{\"SignatureVersion\":\"AWS4-HMAC-SHA256\",\"AuthenticationMethod\":\"AuthHeader\"},\"requestParameters\":{\"bucketName\":\"eastreach-watchpost-manifests\",\"key\":\"signed-routing-bundle.json\"},\"responseElements\":null,\"requestID\":\"0391a7d5-7471-41b5-8de6-102136a3cad0\",\"eventID\":\"2c867f0f-a0f3-468c-8f02-4846e452aa3b\",\"readOnly\":true,\"eventType\":\"AwsApiCall\",\"managementEvent\":false,\"eventCategory\":\"Data\",\"recipientAccountId\":\"719384620571\",\"resources\":[{\"ARN\":\"arn:aws:s3:::eastreach-watchpost-manifests/signed-routing-bundle.json\",\"type\":\"AWS::S3::Object\",\"accountId\":\"719384620571\"},{\"ARN\":\"arn:aws:s3:::eastreach-watchpost-manifests\",\"type\":\"AWS::S3::Bucket\",\"accountId\":\"719384620571\"}]}"
}

Si on regarde le log juste après le GetObject -> PutObject

jq -r '.Events[] | select(.EventName=="PutObject") ' retour.json
{
  "EventId": "26e3d54a-c40c-4ac7-a84e-c46c84c2216c",
  "EventName": "PutObject",
  "ReadOnly": "false",
  "EventTime": "2026-07-27T13:25:19.386000+02:00",
  "EventSource": "s3.amazonaws.com",
  "Resources": [],
  "CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"AWSService\",\"invokedBy\":\"s3.amazonaws.com\",\"servicePrincipal\":\"s3.amazonaws.com\"},\"eventTime\":\"2026-07-27T11:25:19.386Z\",\"eventSource\":\"s3.amazonaws.com\",\"eventName\":\"PutObject\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"s3.amazonaws.com\",\"userAgent\":\"s3.amazonaws.com\",\"requestParameters\":{\"key\":\"eastreach-watchpost-manifests/2026-07-27-11-25-19-e5fdc2abbc684e6a\",\"bucketName\":\"eastreach-manifest-access-logs\"},\"responseElements\":null,\"requestID\":\"3d8983d6-32ae-4681-83a9-f26c0727cc6c\",\"eventID\":\"26e3d54a-c40c-4ac7-a84e-c46c84c2216c\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"managementEvent\":false,\"eventCategory\":\"Data\",\"recipientAccountId\":\"719384620571\"}"
}

Le log S3 qu'on recherche est dans le bucket "bucketName":"eastreach-manifest-access-logs" On regarde la key : "key":"eastreach-watchpost-manifests/2026-07-27-11-25-19-e5fdc2abbc684e6a" Ce qui signifie que S3 a écrit son access log pour l'accès qui vient juste d'avoir lieu car le nom du fichier contient le timestamp du GetObject d'ou le lien entre les deux Events. On va chercher ce log qui est dans eastreach-manifest-access-logs/eastreach-watchpost-manifests/2026-07-27-11-25-19-e5fdc2abbc684e6a

aws s3 cp s3://eastreach-manifest-access-logs/eastreach-watchpost-manifests/2026-07-27-11-25-19-e5fdc2abbc684e6a ./
cat 2026-07-27-11-25-19-e5fdc2abbc684e6a
09778fa77b49a530a9c83b9bf3f58e799e765bc4647e7c2860ed73adb2882326 eastreach-watchpost-manifests [27/Jul/2026:11:25:19 +0000] 203.0.113.88 arn:aws:sts::719384620571:assumed-role/eastreach-dispatch-role/dispatch-runner EAE825F8CB87460D REST.GET.OBJECT signed-routing-bundle.json "GET /eastreach-watchpost-manifests/signed-routing-bundle.json HTTP/1.1" 200 - 621 621 2 1 "-" "Boto3/1.29.7 md/Botocore#1.29.7 ua/2.0 os/linux#5.15.0-107-generic md/arch#x86_64 lang/python#3.10.12 md/pyimpl#CPython cfg/retry-mode#standard Botocore/1.29.7" - 7c5cd942a1c04cedb6d6e5bd22dcd9bc== SigV4 - AuthHeader 127.0.0.1:4566 - - - us-east-1

Flag 15 : REST.GET.OBJECT Le log n'est pas dans CloudTrail car CloudTrail ne stocke pas tous les champs du format access log S3 qui enregistrent le détail de la requête HTTP.

Flag 16

What is the name of the CloudTrail trail the attacker verified before purging queue evidence ?

jq -r '.Events[] | select(.EventName=="GetTrailStatus") | .Resources[0].ResourceName' retour.json
arn:aws:cloudtrail:us-east-1:719384620571:trail/eastreach-watchpost-trail

Flag 16 : eastreach-watchpost-trail

Flag 17

Which API action destroyed the queue evidence at the end of the attack chain ? On avait vu dans le Flag 8 les appel API après le pivot et :

jq -r '.Events[] | select(.EventName=="PurgeQueue")' retour.json
{
  "EventId": "a2ed4b73-3b08-4c76-a02a-e6b158373b4d",
  "EventName": "PurgeQueue",
  "ReadOnly": "false",
  "EventTime": "2026-07-27T13:25:22.169000+02:00",
  "EventSource": "sqs.amazonaws.com",
  "Resources": [
    {
      "ResourceType": "AWS::SQS::Queue",
      "ResourceName": "arn:aws:sqs:us-east-1:719384620571:eastreach-scout-recall-pending"
    }
  ],
  "CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"AssumedRole\",\"sessionContext\":{\"sessionIssuer\":{\"type\":\"Role\",\"principalId\":\"AROA719384620571eastreach-dispatch-role\",\"arn\":\"arn:aws:iam::719384620571:role/eastreach-dispatch-role\",\"accountId\":\"719384620571\",\"userName\":\"eastreach-dispatch-role\"},\"attributes\":{\"creationDate\":\"2026-07-27T11:25:22.169Z\",\"mfaAuthenticated\":\"false\"}},\"principalId\":\"AROA3351AZA3GT4J4K96:dispatch-runner\",\"arn\":\"arn:aws:sts::719384620571:assumed-role/eastreach-dispatch-role/dispatch-runner\",\"accountId\":\"719384620571\",\"accessKeyId\":\"ASIA8ZLJQMTY7TB9XNM4\"},\"eventTime\":\"2026-07-27T11:25:22.169Z\",\"eventSource\":\"sqs.amazonaws.com\",\"eventName\":\"PurgeQueue\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"203.0.113.88\",\"userAgent\":\"Boto3/1.29.7 md/Botocore#1.29.7 ua/2.0 os/linux#5.15.0-107-generic md/arch#x86_64 lang/python#3.10.12 md/pyimpl#CPython cfg/retry-mode#standard Botocore/1.29.7\",\"additionalEventData\":{\"SignatureVersion\":\"AWS4-HMAC-SHA256\",\"AuthenticationMethod\":\"AuthHeader\"},\"requestParameters\":{\"path\":\"/\",\"queueUrl\":\"https://sqs.us-east-1.amazonaws.com/719384620571/eastreach-scout-recall-pending\"},\"responseElements\":null,\"requestID\":\"60b2360f-60d3-4734-b811-647155269993\",\"eventID\":\"a2ed4b73-3b08-4c76-a02a-e6b158373b4d\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"eventCategory\":\"Management\",\"recipientAccountId\":\"719384620571\",\"resources\":[{\"ARN\":\"arn:aws:sqs:us-east-1:719384620571:eastreach-scout-recall-pending\",\"type\":\"AWS::SQS::Queue\",\"accountId\":\"719384620571\"}]}"
}

Flag 17 : PurgeQueue

Flag 18

On retourne dans les anciens logs :

jq -r '.Events[] | select(.EventName=="AssumeRole") | .CloudTrailEvent | fromjson | .userIdentity.userName' retour.json | uniq
eastreach-contractor

Flag 18 : eastreach-contractor o7

← Retour aux projets