HG Logo

Asso' HackGyver 2.0

HTB Cyber Apocalypse 2026 CTF: False Order

Écrit par l’équipe HackGyver – 24 août 2026

Table des matières

Intro

Caldrin Vowmark arrive à un poste de contrôle des Gardes de Cendre muni d’un ordre scellé ordonnant aux soldats de Stormbound de quitter la porte est et de se présenter à Crownspire. L’officier responsable pense que cet ordre émane de Garran Voss, et il va faire partir ses hommes dès que le sceau aura été vérifié. S’ils partent, Vaultrune pourra s’emparer de la porte avant l’arrivée des renforts. Caldrin sait que les ordres de Garran comportent de petits signes que les copistes ne remarquent pas. Il doit inspecter l’ordre, prouver à l’officier qu’il est faux et empêcher l’unité de partir avant que les soldats de Vaultrune n’atteignent la porte. 12 flags à trouver :

1. What was the last CloudTrail API action performed from the internal gatehouse IP immediately before the attacker session began?
2. What was the first CloudTrail API action called from the attacker IP?
3. Which S3 API action did the attacker attempt that was explicitly denied before assuming a role?
4. What is the full S3 path of the object that was tampered with? (format s3://bucket/key)
5. Which IAM role was assumed for the destructive session? (ARN format)
6. What was the full STS principal ARN on the DeleteObject call?
7. From which IP address were the AssumeRole and destructive S3 calls performed?
8. Which IAM username owns the long-lived credentials used to call AssumeRole?
9. Which IAM role name did the attacker fail to assume before the successful AssumeRole? (role name only, not ARN)
10. What roleSessionName was used on the successful AssumeRole into the scanner role?
11. What errorCode did CloudTrail record on the denied GetObject probe before role assumption?
12. Which S3 API action name marks the forged ledger upload after DeleteObject?

Intro d'Analyse

On va aller chercher les événements les plus récents :

aws cloudtrail lookup-events --max-items 10 > retour.txt
{
    "Events": [
        {
            "EventId": "7b89ecc9-6faf-4067-b5b5-1873783f86f3",
            "EventName": "CreateAccessKey",
            "ReadOnly": "false",
            "EventTime": "2026-07-27T14:58:52.365000+02:00",
            "EventSource": "iam.amazonaws.com",
            "Resources": [
                {
                    "ResourceType": "AWS::IAM::User",
                    "ResourceName": "arn:aws:iam::638291047582:user/gate-investigator"
                }
            ],
            "CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"Root\",\"principalId\":\"638291047582\",\"arn\":\"arn:aws:iam::638291047582:root\",\"accountId\":\"638291047582\",\"accessKeyId\":\"AKIA6FALSEORDER01\"},\"eventTime\":\"2026-07-27T12:58:52.365Z\",\"eventSource\":\"iam.amazonaws.com\",\"eventName\":\"CreateAccessKey\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"127.0.0.1\",\"userAgent\":\"Boto3/1.43.47 md/Botocore#1.43.47 ua/2.1 os/linux#6.18.24-talos md/arch#x86_64 lang/python#3.12.13 md/pyimpl#CPython m/N,e,E,Z,b cfg/retry-mode#standard Botocore/1.43.47\",\"additionalEventData\":{\"SignatureVersion\":\"AWS4-HMAC-SHA256\",\"AuthenticationMethod\":\"AuthHeader\"},\"requestParameters\":{\"path\":\"/\",\"userName\":\"gate-investigator\",\"action\":\"CreateAccessKey\"},\"responseElements\":{\"accessKey\":{\"accessKeyId\":\"AKIATI6QA5VCIKNGXBAW\",\"userName\":\"gate-investigator\",\"status\":\"Active\",\"createDate\":\"2026-07-27T07:32:46.328954837Z\"}},\"requestID\":\"bc344b73-cad8-42c3-951d-92034a466dfb\",\"eventID\":\"7b89ecc9-6faf-4067-b5b5-1873783f86f3\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"eventCategory\":\"Management\",\"recipientAccountId\":\"638291047582\",\"resources\":[{\"ARN\":\"arn:aws:iam::638291047582:user/gate-investigator\",\"type\":\"AWS::IAM::User\",\"accountId\":\"638291047582\"}]}"
        },
        {
            "EventId": "8b5d5f00-a12d-458e-9cd4-03ef7334aac1",
            "EventName": "ListAccessKeys",
            "ReadOnly": "true",
            "EventTime": "2026-07-27T14:58:52.364000+02:00",
            "EventSource": "iam.amazonaws.com",
            "Resources": [
                {
                    "ResourceType": "AWS::IAM::User",
                    "ResourceName": "arn:aws:iam::638291047582:user/gate-investigator"
                }
            ],
            "CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"Root\",\"principalId\":\"638291047582\",\"arn\":\"arn:aws:iam::638291047582:root\",\"accountId\":\"638291047582\",\"accessKeyId\":\"AKIA6FALSEORDER01\"},\"eventTime\":\"2026-07-27T12:58:52.364Z\",\"eventSource\":\"iam.amazonaws.com\",\"eventName\":\"ListAccessKeys\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"127.0.0.1\",\"userAgent\":\"Boto3/1.43.47 md/Botocore#1.43.47 ua/2.1 os/linux#6.18.24-talos md/arch#x86_64 lang/python#3.12.13 md/pyimpl#CPython m/e,b,E,N,Z cfg/retry-mode#standard Botocore/1.43.47\",\"additionalEventData\":{\"SignatureVersion\":\"AWS4-HMAC-SHA256\",\"AuthenticationMethod\":\"AuthHeader\"},\"requestParameters\":{\"path\":\"/\",\"userName\":\"gate-investigator\",\"action\":\"ListAccessKeys\"},\"responseElements\":null,\"requestID\":\"59be81eb-38ae-4405-b7e6-33c015dcfdb9\",\"eventID\":\"8b5d5f00-a12d-458e-9cd4-03ef7334aac1\",\"readOnly\":true,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"eventCategory\":\"Management\",\"recipientAccountId\":\"638291047582\",\"resources\":[{\"ARN\":\"arn:aws:iam::638291047582:user/gate-investigator\",\"type\":\"AWS::IAM::User\",\"accountId\":\"638291047582\"}]}"
        },
        {
            "EventId": "90ecdbcd-b1ba-4f2f-982f-3a02f6d8cc72",
            "EventName": "PutUserPolicy",
            "ReadOnly": "false",
            "EventTime": "2026-07-27T14:58:52.363000+02:00",
            "EventSource": "iam.amazonaws.com",
            "Resources": [
                {
                    "ResourceType": "AWS::IAM::User",
                    "ResourceName": "arn:aws:iam::638291047582:user/gate-investigator"
                }
            ],
            "CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"Root\",\"principalId\":\"638291047582\",\"arn\":\"arn:aws:iam::638291047582:root\",\"accountId\":\"638291047582\",\"accessKeyId\":\"AKIA6FALSEORDER01\"},\"eventTime\":\"2026-07-27T12:58:52.363Z\",\"eventSource\":\"iam.amazonaws.com\",\"eventName\":\"PutUserPolicy\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"127.0.0.1\",\"userAgent\":\"Boto3/1.43.47 md/Botocore#1.43.47 ua/2.1 os/linux#6.18.24-talos md/arch#x86_64 lang/python#3.12.13 md/pyimpl#CPython m/e,Z,b,E,N cfg/retry-mode#standard Botocore/1.43.47\",\"additionalEventData\":{\"SignatureVersion\":\"AWS4-HMAC-SHA256\",\"AuthenticationMethod\":\"AuthHeader\"},\"requestParameters\":{\"path\":\"/\",\"userName\":\"gate-investigator\",\"action\":\"PutUserPolicy\"},\"responseElements\":null,\"requestID\":\"9eb9b5af-f2f3-44d7-8be5-801ae1483e01\",\"eventID\":\"90ecdbcd-b1ba-4f2f-982f-3a02f6d8cc72\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"eventCategory\":\"Management\",\"recipientAccountId\":\"638291047582\",\"resources\":[{\"ARN\":\"arn:aws:iam::638291047582:user/gate-investigator\",\"type\":\"AWS::IAM::User\",\"accountId\":\"638291047582\"}]}"
        },
        {
            "EventId": "8422dc37-54b1-41e3-aeae-8032637222e4",
            "EventName": "CreateUser",
            "ReadOnly": "false",
            "EventTime": "2026-07-27T14:58:52.362000+02:00",
            "EventSource": "iam.amazonaws.com",
            "Resources": [
                {
                    "ResourceType": "AWS::IAM::User",
                    "ResourceName": "arn:aws:iam::638291047582:user/gate-investigator"
                }
            ],
            "CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"Root\",\"principalId\":\"638291047582\",\"arn\":\"arn:aws:iam::638291047582:root\",\"accountId\":\"638291047582\",\"accessKeyId\":\"AKIA6FALSEORDER01\"},\"eventTime\":\"2026-07-27T12:58:52.362Z\",\"eventSource\":\"iam.amazonaws.com\",\"eventName\":\"CreateUser\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"127.0.0.1\",\"userAgent\":\"Boto3/1.43.47 md/Botocore#1.43.47 ua/2.1 os/linux#6.18.24-talos md/arch#x86_64 lang/python#3.12.13 md/pyimpl#CPython m/N,e,E,b,Z cfg/retry-mode#standard Botocore/1.43.47\",\"additionalEventData\":{\"SignatureVersion\":\"AWS4-HMAC-SHA256\",\"AuthenticationMethod\":\"AuthHeader\"},\"requestParameters\":{\"path\":\"/\",\"userName\":\"gate-investigator\",\"action\":\"CreateUser\"},\"responseElements\":null,\"requestID\":\"71abe46d-5740-4861-b896-d8eede6348b9\",\"eventID\":\"8422dc37-54b1-41e3-aeae-8032637222e4\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"eventCategory\":\"Management\",\"recipientAccountId\":\"638291047582\",\"resources\":[{\"ARN\":\"arn:aws:iam::638291047582:user/gate-investigator\",\"type\":\"AWS::IAM::User\",\"accountId\":\"638291047582\"}]}"
        },
        {
            "EventId": "e702317a-842c-420c-8b0f-4c5e9018282f",
            "EventName": "DeleteAccessKey",
            "ReadOnly": "false",
            "EventTime": "2026-07-27T14:58:52.361000+02:00",
            "EventSource": "iam.amazonaws.com",
            "Resources": [
                {
                    "ResourceType": "AWS::IAM::User",
                    "ResourceName": "arn:aws:iam::638291047582:user/seal-copyist-contractor"
                }
            ],
            "CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"Root\",\"principalId\":\"638291047582\",\"arn\":\"arn:aws:iam::638291047582:root\",\"accountId\":\"638291047582\",\"accessKeyId\":\"AKIA6FALSEORDER01\"},\"eventTime\":\"2026-07-27T12:58:52.361Z\",\"eventSource\":\"iam.amazonaws.com\",\"eventName\":\"DeleteAccessKey\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"127.0.0.1\",\"userAgent\":\"Boto3/1.43.47 md/Botocore#1.43.47 ua/2.1 os/linux#6.18.24-talos md/arch#x86_64 lang/python#3.12.13 md/pyimpl#CPython m/b,e,Z,E,N cfg/retry-mode#standard Botocore/1.43.47\",\"additionalEventData\":{\"SignatureVersion\":\"AWS4-HMAC-SHA256\",\"AuthenticationMethod\":\"AuthHeader\"},\"requestParameters\":{\"path\":\"/\",\"userName\":\"seal-copyist-contractor\",\"action\":\"DeleteAccessKey\"},\"responseElements\":null,\"requestID\":\"cd2f90b2-ef8e-4e86-b6f2-6082751b5214\",\"eventID\":\"e702317a-842c-420c-8b0f-4c5e9018282f\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"eventCategory\":\"Management\",\"recipientAccountId\":\"638291047582\",\"resources\":[{\"ARN\":\"arn:aws:iam::638291047582:user/seal-copyist-contractor\",\"type\":\"AWS::IAM::User\",\"accountId\":\"638291047582\"}]}"
        },
        {
            "EventId": "40f9b47d-f57f-4e56-a8c2-36600ce3bbf3",
            "EventName": "ListAccessKeys",
            "ReadOnly": "true",
            "EventTime": "2026-07-27T14:58:52.360000+02:00",
            "EventSource": "iam.amazonaws.com",
            "Resources": [
                {
                    "ResourceType": "AWS::IAM::User",
                    "ResourceName": "arn:aws:iam::638291047582:user/seal-copyist-contractor"
                }
            ],
            "CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"Root\",\"principalId\":\"638291047582\",\"arn\":\"arn:aws:iam::638291047582:root\",\"accountId\":\"638291047582\",\"accessKeyId\":\"AKIA6FALSEORDER01\"},\"eventTime\":\"2026-07-27T12:58:52.360Z\",\"eventSource\":\"iam.amazonaws.com\",\"eventName\":\"ListAccessKeys\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"127.0.0.1\",\"userAgent\":\"Boto3/1.43.47 md/Botocore#1.43.47 ua/2.1 os/linux#6.18.24-talos md/arch#x86_64 lang/python#3.12.13 md/pyimpl#CPython m/N,E,e,Z,b cfg/retry-mode#standard Botocore/1.43.47\",\"additionalEventData\":{\"SignatureVersion\":\"AWS4-HMAC-SHA256\",\"AuthenticationMethod\":\"AuthHeader\"},\"requestParameters\":{\"path\":\"/\",\"userName\":\"seal-copyist-contractor\",\"action\":\"ListAccessKeys\"},\"responseElements\":null,\"requestID\":\"1e873de5-891e-4a7d-a90c-48969f9665c1\",\"eventID\":\"40f9b47d-f57f-4e56-a8c2-36600ce3bbf3\",\"readOnly\":true,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"eventCategory\":\"Management\",\"recipientAccountId\":\"638291047582\",\"resources\":[{\"ARN\":\"arn:aws:iam::638291047582:user/seal-copyist-contractor\",\"type\":\"AWS::IAM::User\",\"accountId\":\"638291047582\"}]}"
        },
.......................

On ne voit pas grand-chose malgré des actions faites par le localhost. On va rechercher plus loin dans les événements et les enregistrer au format JSON.

aws cloudtrail lookup-events --max-items 100 > retour.json

On vous épargne le contenu du fichier json mais on va chercher des éléments dedans. Premièrement, récupérer les IP sources :

jq -r '.Events[].CloudTrailEvent | fromjson | .sourceIPAddress' retour.json | uniq

Explication de la commande : jq -r -> permet de manipuler des données au format JSON + -r -> texte brut .Events[].CloudTrailEvent -> prend chaque élément du tableau Events et récupère le champ CloudTrailEvent | fromjson -> le contenu de CloudTrailEvent est une chaîne de caractères contenant du JSON, fromjson convertit cette chaîne en JSON afin qu'il soit possible d'accéder à ses champs. .sourceIPAddress -> récupère uniquement la valeur contenant l'IP.

127.0.0.1
198.18.44.91 -> attack ip ?
10.41.53.22 -> ip intern
10.244.42.31 -> ip intern
92.184.124.38 -> ip public ?

Donc, nous avons toutes nos IP sources. On va chercher tout ce qu'a fait l'IP 198.18.44.91 Avec cette commande :

jq -r '.Events[].CloudTrailEvent | fromjson | select(.sourceIPAddress=="198.18.44.91")' retour.json

On récupère les événements liés à l'IP.

{
  "eventVersion": "1.08",
  "userIdentity": {
    "type": "AssumedRole",
    "sessionContext": {
      "sessionIssuer": {
        "type": "Role",
        "principalId": "AROA638291047582ashguard-order-scanner",
        "arn": "arn:aws:iam::638291047582:role/ashguard-order-scanner",
        "accountId": "638291047582",
        "userName": "ashguard-order-scanner"
      },
      "attributes": {
        "creationDate": "2026-07-27T07:32:39.399Z",
        "mfaAuthenticated": "false"
      }
    },
    "principalId": "AROAOFG08FGCIGMNVPNQ:coalition-gate-clerk",
    "arn": "arn:aws:sts::638291047582:assumed-role/ashguard-order-scanner/coalition-gate-clerk",
    "accountId": "638291047582",
    "accessKeyId": "ASIABJWCCQJ26WL6M08V"
  },
  "eventTime": "2026-07-27T12:58:52.344Z",
  "eventSource": "s3.amazonaws.com",
  "eventName": "PutObject",
  "awsRegion": "us-east-1",
  "sourceIPAddress": "198.18.44.91",
  "userAgent": "Boto3/1.29.7 md/Botocore#1.29.7 ua/2.0 os/linux#5.15.0-107-generic md/arch#x86_64 lang/python#3.10.12 md/pyimpl#CPython cfg/retry-mode#standard Botocore/1.29.7",
  "additionalEventData": {
    "SignatureVersion": "AWS4-HMAC-SHA256",
    "AuthenticationMethod": "AuthHeader"
  },
  "requestParameters": {
    "bucketName": "ashguard-order-custody",
    "key": "custody/east-gate-order.json"
  },
  "responseElements": {
    "x-amz-version-id": "772a341d-4c26-4de1-9430-ac15f476680b"
  },
  "requestID": "86d7313c-7195-4d2c-bbac-7bcc50522432",
  "eventID": "7851edf4-2fff-4639-ba61-60f22861d4fd",
  "readOnly": false,
  "eventType": "AwsApiCall",
  "managementEvent": false,
  "eventCategory": "Data",
  "recipientAccountId": "638291047582",
  "resources": [
    {
      "ARN": "arn:aws:s3:::ashguard-order-custody/custody/east-gate-order.json",
      "type": "AWS::S3::Object",
      "accountId": "638291047582"
    },
    {
      "ARN": "arn:aws:s3:::ashguard-order-custody",
      "type": "AWS::S3::Bucket",
      "accountId": "638291047582"
    }
  ]
}
........................

Une des questions pour obtenir le flag 2 est : Quelle a été la première action API CloudTrail appelée depuis l'adresse IP de l'attaquant ? Réponse : GetCallerIdentity

jq -r '.Events[].CloudTrailEvent | fromjson | select(.sourceIPAddress=="198.18.44.91") | [.eventTime, .eventName] | @tsv ' retour.json | sort

Explication : [.eventTime, .eventName] -> construit un tableau avec les valeurs de eventTime et eventName @tsv -> formatteur de sortie qui transforme un tableau en ligne de texte séparé par des tabulations. Retour :

2026-07-27T04:33:35.389Z	GetCallerIdentity
2026-07-27T04:46:48.137Z	ListBuckets
2026-07-27T04:59:01.050Z	ListObjectsV2
2026-07-27T05:13:37.534Z	GetObject
2026-07-27T05:35:02.658Z	ListObjectsV2
2026-07-27T05:51:34.916Z	ListObjectsV2
2026-07-27T06:09:09.634Z	AssumeRole
2026-07-27T06:27:35.503Z	ListBuckets
2026-07-27T06:45:44.384Z	ListObjectsV2
2026-07-27T06:55:51.737Z	ListObjectsV2
2026-07-27T07:14:23.618Z	ListObjectsV2
2026-07-27T12:58:52.335Z	GetCallerIdentity
2026-07-27T12:58:52.336Z	ListAllMyBuckets
2026-07-27T12:58:52.337Z	ListObjectsV2
2026-07-27T12:58:52.338Z	GetObject
2026-07-27T12:58:52.339Z	AssumeRole
2026-07-27T12:58:52.340Z	AssumeRole
2026-07-27T12:58:52.341Z	GetCallerIdentity
2026-07-27T12:58:52.342Z	ListBucketVersions
2026-07-27T12:58:52.343Z	DeleteObject
2026-07-27T12:58:52.344Z	PutObject

Recherche de Flag

Flag 1

What was the last CloudTrail API action performed from the internal gatehouse IP immediately before the attacker session began ? On a vu que, juste avant l'IP de l'attaquant, l'IP interne potentielle est 10.41.53.22

jq -r '.Events[].CloudTrailEvent | fromjson | select(.sourceIPAddress=="10.41.53.22") | [.eventTime, .eventName] | @tsv' retour.json | sort | uniq
2026-07-27T12:58:52.334Z	ListObjectsV2

Flag 1 : ListObjectsV2

Flag 2

jq -r '.Events[].CloudTrailEvent | fromjson | select(.sourceIPAddress=="198.18.44.91") | [.eventTime, .eventName] | @tsv ' retour.json | sort

Flag 2 : GetCallerIdentity

Flag 3

Which S3 API action did the attacker attempt that was explicitly denied before assuming a role ?

jq -r '.Events[] | select(.EventName=="AssumeRole" or .EventName=="GetObject" or .EventName=="DeleteObject")' retour.json
{
  "EventId": "61845fc4-5d58-4c1f-a2c6-aaf46e00acd2",
  "EventName": "AssumeRole",
  "ReadOnly": "true",
  "EventTime": "2026-07-27T08:09:09.634000+02:00",
  "EventSource": "sts.amazonaws.com",
  "Username": "seal-copyist-contractor",
  "Resources": [],
  "CloudTrailEvent": "{\"eventVersion\":\"1.11\",\"userIdentity\":{\"type\":\"IAMUser\",\"principalId\":\"AIDACCEW8ZI4\",\"arn\":\"arn:aws:iam::638291047582:user/seal-copyist-contractor\",\"accountId\":\"638291047582\",\"accessKeyId\":\"AKIAJP3FAK1HCCEW8ZI4\",\"userName\":\"seal-copyist-contractor\"},\"eventTime\":\"2026-07-27T06:09:09.634Z\",\"eventSource\":\"sts.amazonaws.com\",\"eventName\":\"AssumeRole\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"198.18.44.91\",\"userAgent\":\"Boto3/1.29.7 md/Botocore#1.29.7 ua/2.0 os/linux#5.15.0-107-generic md/arch#x86_64 lang/python#3.10.12 md/pyimpl#CPython cfg/retry-mode#standard Botocore/1.29.7\",\"requestParameters\":{\"roleArn\":\"arn:aws:iam::638291047582:role/ashguard-order-auditor\",\"roleSessionName\":\"seal-copyist-session\"},\"responseElements\":null,\"readOnly\":true,\"eventType\":\"AwsApiCall\",\"managementEvent\":false,\"recipientAccountId\":\"638291047582\",\"eventID\":\"61845fc4-5d58-4c1f-a2c6-aaf46e00acd2\",\"errorCode\":\"AccessDenied\",\"errorMessage\":\"An error occurred (AccessDenied) when calling the operation\"}"
}
{
  "EventId": "639f1018-7a8e-4ec1-a6a4-7a1fd0a19886",
  "EventName": "GetObject",
  "ReadOnly": "true",
  "EventTime": "2026-07-27T07:13:37.534000+02:00",
  "EventSource": "s3.amazonaws.com",
  "Username": "seal-copyist-contractor",
  "Resources": [],
  "CloudTrailEvent": "{\"eventVersion\":\"1.11\",\"userIdentity\":{\"type\":\"IAMUser\",\"principalId\":\"AIDACCEW8ZI4\",\"arn\":\"arn:aws:iam::638291047582:user/seal-copyist-contractor\",\"accountId\":\"638291047582\",\"accessKeyId\":\"AKIAJP3FAK1HCCEW8ZI4\",\"userName\":\"seal-copyist-contractor\"},\"eventTime\":\"2026-07-27T05:13:37.534Z\",\"eventSource\":\"s3.amazonaws.com\",\"eventName\":\"GetObject\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"198.18.44.91\",\"userAgent\":\"Boto3/1.29.7 md/Botocore#1.29.7 ua/2.0 os/linux#5.15.0-107-generic md/arch#x86_64 lang/python#3.10.12 md/pyimpl#CPython cfg/retry-mode#standard Botocore/1.29.7\",\"requestParameters\":{\"bucketName\":\"ashguard-order-custody\",\"key\":\"custody/east-gate-order.json\"},\"responseElements\":null,\"readOnly\":true,\"eventType\":\"AwsApiCall\",\"managementEvent\":false,\"recipientAccountId\":\"638291047582\",\"eventID\":\"639f1018-7a8e-4ec1-a6a4-7a1fd0a19886\",\"errorCode\":\"AccessDenied\",\"errorMessage\":\"An error occurred (AccessDenied) when calling the operation\"}"
}
.................

Flag 3 : GetObject

Flag 4

What is the full S3 path of the object that was tampered with? (format s3://bucket/key)

jq -r '.Events[] | select(.EventName=="DeleteObject") | .CloudTrailEvent | fromjson | [.requestParameters.bucketName, .requestParameters.key] | @tsv' retour.json
ashguard-order-custody	custody/east-gate-order.json

Flag 4 : s3://ashguard-order-custody/custody/east-gate-order.json

Flag 5

Which IAM role was assumed for the destructive session? (ARN format)

jq -r '.Events[] | select(.EventName=="AssumeRole") | .CloudTrailEvent | fromjson | select(.responseElements != null) | [.requestParameters.roleArn] | @tsv' retour.json
arn:aws:iam::638291047582:role/ashguard-order-scanner

Flag 5 : arn:aws:iam::638291047582:role/ashguard-order-scanner

Flag 6

What was the full STS principal ARN on the DeleteObject call ?

jq -r '.Events[] | select(.EventName=="DeleteObject") | .CloudTrailEvent | fromjson | [.userIdentity.arn] | @tsv' retour.json
arn:aws:sts::638291047582:assumed-role/ashguard-order-scanner/coalition-gate-clerk

Flag 6 : arn:aws:sts::638291047582:assumed-role/ashguard-order-scanner/coalition-gate-clerk

Flag 7

From which IP address were the AssumeRole and destructive S3 calls performed ?

jq -r '.Events[] | select(.EventName=="AssumeRole") | .CloudTrailEvent | fromjson | [.sourceIPAddress] | @tsv' retour.json | uniq
198.18.44.91

Flag 7 : 198.18.44.91

Flag 8

Which IAM username owns the long-lived credentials used to call AssumeRole ?

jq -r '.Events[] | select(.EventName=="AssumeRole") | .CloudTrailEvent | fromjson | [.userIdentity.userName] | @tsv' retour.json | uniq
seal-copyist-contractor

Flag 8 : seal-copyist-contractor

Flag 9

Which IAM role name did the attacker fail to assume before the successful AssumeRole? (role name only, not ARN)

jq -r '.Events[] | select(.EventName=="AssumeRole") | .CloudTrailEvent | fromjson | select(.errorCode=="AccessDenied") | .requestParameters.roleArn' retour.json | uniq
arn:aws:iam::638291047582:role/ashguard-order-auditor

Flag 9 : ashguard-order-auditor

Flag 10

What roleSessionName was used on the successful AssumeRole into the scanner role ?

jq -r '.Events[] | select(.EventName=="AssumeRole")' retour.json

Nous avons pris le seul log contenant "ResourceName": "arn:aws:iam::638291047582:role/ashguard-order-scanner"

"roleSessionName":"coalition-gate-clerk"

Flag 10 : coalition-gate-clerk

Flag 11

What errorCode did CloudTrail record on the denied GetObject probe before role assumption ? On l'a vu dans le Flag 3 sur le log du GetObject Flag 11 : AccessDenied

Flag 12

Which S3 API action name marks the forged ledger upload after DeleteObject ?

jq -r '.Events[] | select(.EventSource=="s3.amazonaws.com") | [.EventTime, .EventName] | @tsv' retour.json
2026-07-27T14:58:52.357000+02:00	ListBucketVersions
2026-07-27T14:58:52.344000+02:00	PutObject
2026-07-27T14:58:52.343000+02:00	DeleteObject
2026-07-27T14:58:52.342000+02:00	ListBucketVersions
2026-07-27T14:58:52.338000+02:00	GetObject

Flag 12 : PutObject. Dans AWS, un upload d'objet est généralement réalisé par l'API PutObject o7

← Retour aux projets