HTB Cyber Apocalypse 2026 CTF: Wrong Stamp

Écrit par l’équipe HackGyver – 24 août 2026

Table des matières

Intro
Objectif
Consulter les derniers événements CloudTrail
Analyser plus loin
Résultat des flags :

Intro

Elric Ashspar trouve un cachet de saisie dans le sac d'un employé décédé près de Stonepass. Vaultrune utilise des copies de ce cachet pour dérober des provisions aux gardes-frontières de Sythra, laissant ainsi ouverte une route dont Stormbound a besoin sans qu'ils ne s'en aperçoivent. Le cachet semble ancien, mais Elric remarque des traces d'outils récentes dessus. Il doit trouver la faille, prouver que le cachet est un faux et fournir aux gardes un moyen rapide de repérer les futures copies. 8 flags à trouver :

1. What was the last CloudTrail API action performed by the compromised user from the internal IP immediately before the attacker session began ?
2. What was the first CloudTrail API action called from the attacker IP?
3. Which API action did the attacker attempt that was explicitly denied before the trail was stopped?
4. Which S3 bucket did the attacker enumerate before stopping the trail?
5. What is the name of the CloudTrail trail that was stopped?
6. Which IAM username's credentials were used to execute the trail disable?
7. From which IP address was the trail disabled?
8. Which API action was used to disable the audit trail?

Objectif

Analyser les événements AWS afin de reconstituer les dernières actions de l'attaquant. En utilisant AWS CloudTrail, qui est un service AWS permettant d’enregistrer toutes les actions effectuées dans un compte AWS.

Consulter les derniers événements CloudTrail

La première commande à exécuter est :

aws cloudtrail lookup-events --max-items 5 > retour.txt

Cette commande permet de récupérer les 5 événements CloudTrail les plus récents. Résultat :

{
    "Events": [
        {
            "EventId": "e177184a-c2f3-411b-9560-8682cc8ee6cd",
            "EventName": "ListTrails",
            "ReadOnly": "true",
            "EventTime": "2026-07-26T20:40:33.321000+02:00",
            "EventSource": "cloudtrail.amazonaws.com",
            "Username": "stonepass-investigator",
            "Resources": [
                {
                    "ResourceType": "AWS::CloudTrail::Trail",
                    "ResourceName": "arn:aws:cloudtrail:us-east-1:491827305948:trail/*"
                }
            ],
            "CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"IAMUser\",\"userName\":\"stonepass-investigator\",\"sessionContext\":{\"attributes\":{\"mfaAuthenticated\":\"false\",\"creationDate\":\"2026-07-26T18:40:33.321Z\"}},\"principalId\":\"AIDAWKOFDZY0GNV0UXP7\",\"arn\":\"arn:aws:iam::491827305948:user/stonepass-investigator\",\"accountId\":\"491827305948\",\"accessKeyId\":\"AKIATF2N9XM4VLQ3G8BR\"},\"eventTime\":\"2026-07-26T18:40:33.321Z\",\"eventSource\":\"cloudtrail.amazonaws.com\",\"eventName\":\"ListTrails\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"88.162.105.238\",\"userAgent\":\"aws-cli/2.27.3 md/awscrt#0.25.4 ua/2.1 os/linux#7.0.0-28-generic md/arch#x86_64 lang/python#3.13.2 md/pyimpl#CPython m/N,C cfg/retry-mode#standard md/installer#exe md/distrib#debian.12 md/prompt#off md/command#cloudtrail.list-trails\",\"additionalEventData\":{\"SignatureVersion\":\"AWS4-HMAC-SHA256\",\"AuthenticationMethod\":\"AuthHeader\"},\"requestParameters\":{\"path\":\"/\"},\"responseElements\":null,\"requestID\":\"a344c8e2-cea6-4fa4-b57e-6c1d2447ba2e\",\"eventID\":\"e177184a-c2f3-411b-9560-8682cc8ee6cd\",\"readOnly\":true,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"eventCategory\":\"Management\",\"recipientAccountId\":\"491827305948\",\"resources\":[{\"ARN\":\"arn:aws:cloudtrail:us-east-1:491827305948:trail/*\",\"type\":\"AWS::CloudTrail::Trail\",\"accountId\":\"491827305948\"}],\"errorCode\":\"AccessDeniedException\",\"errorMessage\":\"User is not authorized to perform: cloudtrail:ListTrails\"}"
        },
        {
            "EventId": "ad69215a-d6b4-4090-900f-048c564069cd",
            "EventName": "StopLogging",
            "ReadOnly": "false",
            "EventTime": "2026-07-26T20:37:34.649000+02:00",
            "EventSource": "cloudtrail.amazonaws.com",
            "Username": "stonepass-warden",
            "Resources": [
                {
                    "ResourceType": "AWS::CloudTrail::Trail",
                    "ResourceName": "arn:aws:cloudtrail:us-east-1:491827305948:trail/stonepass-audit-trail"
                }
            ],
            "CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"IAMUser\",\"userName\":\"stonepass-warden\",\"sessionContext\":{\"attributes\":{\"mfaAuthenticated\":\"false\",\"creationDate\":\"2026-07-26T18:37:34.649Z\"}},\"principalId\":\"AIDA5MJ3BVHFTE6MUWN4\",\"arn\":\"arn:aws:iam::491827305948:user/stonepass-warden\",\"accountId\":\"491827305948\",\"accessKeyId\":\"AKIAXIDIEXT1LH8NFJV8\"},\"eventTime\":\"2026-07-26T18:37:34.649Z\",\"eventSource\":\"cloudtrail.amazonaws.com\",\"eventName\":\"StopLogging\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"192.0.2.55\",\"userAgent\":\"Boto3/1.29.7 md/Botocore#1.29.7 ua/2.0 os/linux#5.15.0-107-generic md/arch#x86_64 lang/python#3.10.12 md/pyimpl#CPython cfg/retry-mode#standard Botocore/1.29.7\",\"additionalEventData\":{\"SignatureVersion\":\"AWS4-HMAC-SHA256\",\"AuthenticationMethod\":\"AuthHeader\"},\"requestParameters\":{\"path\":\"/\",\"name\":\"stonepass-audit-trail\"},\"responseElements\":null,\"requestID\":\"4ed79a99-52da-4a62-8270-85be48603413\",\"eventID\":\"ad69215a-d6b4-4090-900f-048c564069cd\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"eventCategory\":\"Management\",\"recipientAccountId\":\"491827305948\",\"resources\":[{\"ARN\":\"arn:aws:cloudtrail:us-east-1:491827305948:trail/stonepass-audit-trail\",\"type\":\"AWS::CloudTrail::Trail\",\"accountId\":\"491827305948\"}]}"
        },
        {
            "EventId": "2b9d8535-588e-42b6-9e7a-e2899ffbee40",
            "EventName": "GetObject",
            "ReadOnly": "true",
            "EventTime": "2026-07-26T20:37:33.020000+02:00",
            "EventSource": "s3.amazonaws.com",
            "Username": "stonepass-warden",
            "Resources": [
                {
                    "ResourceType": "AWS::S3::Object",
                    "ResourceName": "arn:aws:s3:::stonepass-audit-trail-logs/AWSLogs/us-east-1/CloudTrail/us-east-1/2026/06/24/audit.log.gz"
                },
                {
                    "ResourceType": "AWS::S3::Bucket",
                    "ResourceName": "arn:aws:s3:::stonepass-audit-trail-logs"
                }
            ],
            "CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"IAMUser\",\"userName\":\"stonepass-warden\",\"sessionContext\":{\"attributes\":{\"mfaAuthenticated\":\"false\",\"creationDate\":\"2026-07-26T18:37:33.020Z\"}},\"principalId\":\"AIDA5MJ3BVHFTE6MUWN4\",\"arn\":\"arn:aws:iam::491827305948:user/stonepass-warden\",\"accountId\":\"491827305948\",\"accessKeyId\":\"AKIAXIDIEXT1LH8NFJV8\"},\"eventTime\":\"2026-07-26T18:37:33.020Z\",\"eventSource\":\"s3.amazonaws.com\",\"eventName\":\"GetObject\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"192.0.2.55\",\"userAgent\":\"Boto3/1.29.7 md/Botocore#1.29.7 ua/2.0 os/linux#5.15.0-107-generic md/arch#x86_64 lang/python#3.10.12 md/pyimpl#CPython cfg/retry-mode#standard Botocore/1.29.7\",\"additionalEventData\":{\"SignatureVersion\":\"AWS4-HMAC-SHA256\",\"AuthenticationMethod\":\"AuthHeader\"},\"requestParameters\":{\"bucketName\":\"stonepass-audit-trail-logs\",\"key\":\"AWSLogs/us-east-1/CloudTrail/us-east-1/2026/06/24/audit.log.gz\"},\"responseElements\":null,\"requestID\":\"0c30efef-d336-42a2-9ffe-d0b2ba224a49\",\"eventID\":\"2b9d8535-588e-42b6-9e7a-e2899ffbee40\",\"readOnly\":true,\"eventType\":\"AwsApiCall\",\"managementEvent\":false,\"eventCategory\":\"Data\",\"recipientAccountId\":\"491827305948\",\"resources\":[{\"ARN\":\"arn:aws:s3:::stonepass-audit-trail-logs/AWSLogs/us-east-1/CloudTrail/us-east-1/2026/06/24/audit.log.gz\",\"type\":\"AWS::S3::Object\",\"accountId\":\"491827305948\"},{\"ARN\":\"arn:aws:s3:::stonepass-audit-trail-logs\",\"type\":\"AWS::S3::Bucket\",\"accountId\":\"491827305948\"}],\"errorCode\":\"NoSuchKey\",\"errorMessage\":\"The specified key does not exist.\"}"
        },
        {
            "EventId": "1defd004-a64a-4a36-b27e-350405e07587",
            "EventName": "ListObjectsV2",
            "ReadOnly": "true",
            "EventTime": "2026-07-26T20:37:31.201000+02:00",
            "EventSource": "s3.amazonaws.com",
            "Username": "stonepass-warden",
            "Resources": [
                {
                    "ResourceType": "AWS::S3::Bucket",
                    "ResourceName": "arn:aws:s3:::stonepass-audit-trail-logs"
                }
            ],
            "CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"IAMUser\",\"userName\":\"stonepass-warden\",\"sessionContext\":{\"attributes\":{\"mfaAuthenticated\":\"false\",\"creationDate\":\"2026-07-26T18:37:31.201Z\"}},\"principalId\":\"AIDA5MJ3BVHFTE6MUWN4\",\"arn\":\"arn:aws:iam::491827305948:user/stonepass-warden\",\"accountId\":\"491827305948\",\"accessKeyId\":\"AKIAXIDIEXT1LH8NFJV8\"},\"eventTime\":\"2026-07-26T18:37:31.201Z\",\"eventSource\":\"s3.amazonaws.com\",\"eventName\":\"ListObjectsV2\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"192.0.2.55\",\"userAgent\":\"Boto3/1.29.7 md/Botocore#1.29.7 ua/2.0 os/linux#5.15.0-107-generic md/arch#x86_64 lang/python#3.10.12 md/pyimpl#CPython cfg/retry-mode#standard Botocore/1.29.7\",\"additionalEventData\":{\"SignatureVersion\":\"AWS4-HMAC-SHA256\",\"AuthenticationMethod\":\"AuthHeader\"},\"requestParameters\":{\"bucketName\":\"stonepass-audit-trail-logs\",\"encoding-type\":\"url\",\"max-keys\":\"10\",\"list-type\":\"2\"},\"responseElements\":null,\"requestID\":\"c2066ee5-d980-4f0f-a1c2-b197b2536a79\",\"eventID\":\"1defd004-a64a-4a36-b27e-350405e07587\",\"readOnly\":true,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"eventCategory\":\"Management\",\"recipientAccountId\":\"491827305948\",\"resources\":[{\"ARN\":\"arn:aws:s3:::stonepass-audit-trail-logs\",\"type\":\"AWS::S3::Bucket\",\"accountId\":\"491827305948\"}]}"
        },
        {
            "EventId": "391b1101-ffa1-47cf-be34-1521fbf2104d",
            "EventName": "ListBucket",
            "ReadOnly": "true",
            "EventTime": "2026-07-26T20:37:29.186000+02:00",
            "EventSource": "s3.amazonaws.com",
            "Username": "stonepass-warden",
            "Resources": [
                {
                    "ResourceType": "AWS::S3::Bucket",
                    "ResourceName": "arn:aws:s3:::stonepass-audit-trail-logs"
                }
            ],
            "CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"IAMUser\",\"userName\":\"stonepass-warden\",\"sessionContext\":{\"attributes\":{\"mfaAuthenticated\":\"false\",\"creationDate\":\"2026-07-26T18:37:29.186Z\"}},\"principalId\":\"AIDA5MJ3BVHFTE6MUWN4\",\"arn\":\"arn:aws:iam::491827305948:user/stonepass-warden\",\"accountId\":\"491827305948\",\"accessKeyId\":\"AKIAXIDIEXT1LH8NFJV8\"},\"eventTime\":\"2026-07-26T18:37:29.186Z\",\"eventSource\":\"s3.amazonaws.com\",\"eventName\":\"ListBucket\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"192.0.2.55\",\"userAgent\":\"Boto3/1.29.7 md/Botocore#1.29.7 ua/2.0 os/linux#5.15.0-107-generic md/arch#x86_64 lang/python#3.10.12 md/pyimpl#CPython cfg/retry-mode#standard Botocore/1.29.7\",\"additionalEventData\":{\"SignatureVersion\":\"AWS4-HMAC-SHA256\",\"AuthenticationMethod\":\"AuthHeader\"},\"requestParameters\":{\"bucketName\":\"stonepass-audit-trail-logs\",\"location\":\"\"},\"responseElements\":null,\"requestID\":\"480be426-4cb2-4c4e-9c81-674e175836f9\",\"eventID\":\"391b1101-ffa1-47cf-be34-1521fbf2104d\",\"readOnly\":true,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"eventCategory\":\"Management\",\"recipientAccountId\":\"491827305948\",\"resources\":[{\"ARN\":\"arn:aws:s3:::stonepass-audit-trail-logs\",\"type\":\"AWS::S3::Bucket\",\"accountId\":\"491827305948\"}]}"
        }
    ],
    "NextToken": "eyJ0IjoxNzg1MDkxMDQ5MTg2LCJzIjoyNjUsImlkIjoiMzkxYjExMDEtZmZhMS00N2NmLWJlMzQtMTUyMWZiZjIxMDRkIn0"
}

Nous avons identifié 5 éléments qui permettent de répondre aux flags : Flag 4 : Quel bucket S3 l'attaquant a-t-il exploré avant d'arrêter la piste d'audit ? stonepass-audit-trail-logs -> log avec comme "EventName": "GetObject".

Flag 5 : Quel est le nom de la piste CloudTrail qui a été arrêtée ? stonepass-audit-trail -> log avec comme "EventName": "StopLogging"

Flag 6 : Quels identifiants d'un utilisateur IAM : stonepass-warden -> même évent que le flag 5 "IAMUser","userName":"stonepass-warden"

Flag 7 : On cherche son adresse IP : Même event -> 192.0.2.55

Flag 8 : On cherche l'action et on fait référence direct a l'event name : StopLogging

Analyser plus loin

Ensuite, nous avons cherché plus loin dans l'historique mais cette fois en utilisant le NextToken retourné par la commande précédente :

aws cloudtrail lookup-events --max-items 20 --next-token 'eyJ0IjoxNzg1MDkxMDQ5MTg2LCJzIjoyNjUsImlkIjoiMzkxYjExMDEtZmZhMS00N2NmLWJlMzQtMTUyMWZiZjIxMDRkIn0' > retour2.txt

Et en fouillant dans le resultat :

{
    "Events": [
        {
            "EventId": "ea10d999-aafa-40ab-9860-81d2ac7221ba",
            "EventName": "DeleteTrail",
            "ReadOnly": "false",
            "EventTime": "2026-07-26T20:37:27.171000+02:00",
            "EventSource": "cloudtrail.amazonaws.com",
            "Username": "stonepass-warden",
            "Resources": [
                {
                    "ResourceType": "AWS::CloudTrail::Trail",
                    "ResourceName": "arn:aws:cloudtrail:us-east-1:491827305948:trail/stonepass-audit-trail"
                }
            ],
            "CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"IAMUser\",\"userName\":\"stonepass-warden\",\"sessionContext\":{\"attributes\":{\"mfaAuthenticated\":\"false\",\"creationDate\":\"2026-07-26T18:37:27.171Z\"}},\"principalId\":\"AIDA5MJ3BVHFTE6MUWN4\",\"arn\":\"arn:aws:iam::491827305948:user/stonepass-warden\",\"accountId\":\"491827305948\",\"accessKeyId\":\"AKIAXIDIEXT1LH8NFJV8\"},\"eventTime\":\"2026-07-26T18:37:27.171Z\",\"eventSource\":\"cloudtrail.amazonaws.com\",\"eventName\":\"DeleteTrail\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"192.0.2.55\",\"userAgent\":\"Boto3/1.29.7 md/Botocore#1.29.7 ua/2.0 os/linux#5.15.0-107-generic md/arch#x86_64 lang/python#3.10.12 md/pyimpl#CPython cfg/retry-mode#standard Botocore/1.29.7\",\"additionalEventData\":{\"SignatureVersion\":\"AWS4-HMAC-SHA256\",\"AuthenticationMethod\":\"AuthHeader\"},\"requestParameters\":{\"path\":\"/\",\"name\":\"stonepass-audit-trail\"},\"responseElements\":null,\"requestID\":\"46e40cb1-3f1a-4fca-81e8-2933b512ce6a\",\"eventID\":\"ea10d999-aafa-40ab-9860-81d2ac7221ba\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"eventCategory\":\"Management\",\"recipientAccountId\":\"491827305948\",\"resources\":[{\"ARN\":\"arn:aws:cloudtrail:us-east-1:491827305948:trail/stonepass-audit-trail\",\"type\":\"AWS::CloudTrail::Trail\",\"accountId\":\"491827305948\"}],\"errorCode\":\"AccessDeniedException\",\"errorMessage\":\"User is not authorized to perform: cloudtrail:DeleteTrail\"}"
        },
        {
            "EventId": "8403ed62-0d09-4896-9071-a2ea77c1f3ee",
            "EventName": "GetTrailStatus",
            "ReadOnly": "true",
            "EventTime": "2026-07-26T20:37:24.696000+02:00",
            "EventSource": "cloudtrail.amazonaws.com",
            "Username": "stonepass-warden",
            "Resources": [
                {
                    "ResourceType": "AWS::CloudTrail::Trail",
                    "ResourceName": "arn:aws:cloudtrail:us-east-1:491827305948:trail/stonepass-audit-trail"
                }
            ],
            "CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"IAMUser\",\"userName\":\"stonepass-warden\",\"sessionContext\":{\"attributes\":{\"mfaAuthenticated\":\"false\",\"creationDate\":\"2026-07-26T18:37:24.696Z\"}},\"principalId\":\"AIDA5MJ3BVHFTE6MUWN4\",\"arn\":\"arn:aws:iam::491827305948:user/stonepass-warden\",\"accountId\":\"491827305948\",\"accessKeyId\":\"AKIAXIDIEXT1LH8NFJV8\"},\"eventTime\":\"2026-07-26T18:37:24.696Z\",\"eventSource\":\"cloudtrail.amazonaws.com\",\"eventName\":\"GetTrailStatus\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"192.0.2.55\",\"userAgent\":\"Boto3/1.29.7 md/Botocore#1.29.7 ua/2.0 os/linux#5.15.0-107-generic md/arch#x86_64 lang/python#3.10.12 md/pyimpl#CPython cfg/retry-mode#standard Botocore/1.29.7\",\"additionalEventData\":{\"SignatureVersion\":\"AWS4-HMAC-SHA256\",\"AuthenticationMethod\":\"AuthHeader\"},\"requestParameters\":{\"path\":\"/\",\"name\":\"stonepass-audit-trail\"},\"responseElements\":null,\"requestID\":\"d7a3a755-a00d-43d4-9a4d-a120ea8c7760\",\"eventID\":\"8403ed62-0d09-4896-9071-a2ea77c1f3ee\",\"readOnly\":true,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"eventCategory\":\"Management\",\"recipientAccountId\":\"491827305948\",\"resources\":[{\"ARN\":\"arn:aws:cloudtrail:us-east-1:491827305948:trail/stonepass-audit-trail\",\"type\":\"AWS::CloudTrail::Trail\",\"accountId\":\"491827305948\"}]}"
        },
        {
            "EventId": "2984f181-2c50-45c1-9f79-a34c82d8c51d",
            "EventName": "Unknown",
            "ReadOnly": "false",
            "EventTime": "2026-07-26T20:37:08.531000+02:00",
            "EventSource": "unknown.amazonaws.com",
            "Resources": [],
            "CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"Root\",\"principalId\":\"491827305948\",\"arn\":\"arn:aws:iam::491827305948:root\",\"accountId\":\"491827305948\"},\"eventTime\":\"2026-07-26T18:37:08.531Z\",\"eventSource\":\"unknown.amazonaws.com\",\"eventName\":\"Unknown\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"88.162.105.238\",\"userAgent\":\"Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:152.0) Gecko/20100101 Firefox/152.0\",\"requestParameters\":{\"path\":\"/\"},\"responseElements\":null,\"requestID\":\"44a4840a-1095-4905-806d-4af9a9c9de33\",\"eventID\":\"2984f181-2c50-45c1-9f79-a34c82d8c51d\",\"readOnly\":false,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"eventCategory\":\"Management\",\"recipientAccountId\":\"491827305948\",\"errorCode\":\"AccessDeniedException\",\"errorMessage\":\"User is not authorized to perform: MissingAuthentication\"}"
        },
        {
            "EventId": "b135f3b4-7ca9-4735-9d21-4261b42df9dd",
            "EventName": "ListAccessKeys",
            "ReadOnly": "true",
            "EventTime": "2026-07-26T20:37:03.650000+02:00",
            "EventSource": "iam.amazonaws.com",
            "Username": "stonepass-warden",
            "Resources": [
                {
                    "ResourceType": "AWS::IAM::User",
                    "ResourceName": "arn:aws:iam::491827305948:user/stonepass-warden"
                }
            ],
            "CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"IAMUser\",\"userName\":\"stonepass-warden\",\"sessionContext\":{\"attributes\":{\"mfaAuthenticated\":\"false\",\"creationDate\":\"2026-07-26T18:37:03.650Z\"}},\"principalId\":\"AIDA5MJ3BVHFTE6MUWN4\",\"arn\":\"arn:aws:iam::491827305948:user/stonepass-warden\",\"accountId\":\"491827305948\",\"accessKeyId\":\"AKIAXIDIEXT1LH8NFJV8\"},\"eventTime\":\"2026-07-26T18:37:03.650Z\",\"eventSource\":\"iam.amazonaws.com\",\"eventName\":\"ListAccessKeys\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"10.30.41.118\",\"userAgent\":\"Boto3/1.34.0 md/Botocore#1.34.0 ua/2.0 os/linux#5.15.167.4-lts-hwe md/arch#x86_64 lang/python#3.11.9 md/pyimpl#CPython exec-env/EC2 cfg/retry-mode#standard Botocore/1.34.0\",\"additionalEventData\":{\"SignatureVersion\":\"AWS4-HMAC-SHA256\",\"AuthenticationMethod\":\"AuthHeader\"},\"requestParameters\":{\"path\":\"/\",\"userName\":\"stonepass-warden\",\"action\":\"ListAccessKeys\"},\"responseElements\":null,\"requestID\":\"461b847d-c95b-41aa-a428-cce7d7bc2bce\",\"eventID\":\"b135f3b4-7ca9-4735-9d21-4261b42df9dd\",\"readOnly\":true,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"eventCategory\":\"Management\",\"recipientAccountId\":\"491827305948\",\"resources\":[{\"ARN\":\"arn:aws:iam::491827305948:user/stonepass-warden\",\"type\":\"AWS::IAM::User\",\"accountId\":\"491827305948\"}]}"
        },
        {
            "EventId": "f70df636-0b5f-49b2-add3-49b139b6ac9f",
            "EventName": "GetUser",
            "ReadOnly": "true",
            "EventTime": "2026-07-26T20:37:02.435000+02:00",
            "EventSource": "iam.amazonaws.com",
            "Username": "stonepass-warden",
            "Resources": [
                {
                    "ResourceType": "AWS::IAM::User",
                    "ResourceName": "arn:aws:iam::491827305948:user/stonepass-warden"
                }
            ],
            "CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"IAMUser\",\"userName\":\"stonepass-warden\",\"sessionContext\":{\"attributes\":{\"mfaAuthenticated\":\"false\",\"creationDate\":\"2026-07-26T18:37:02.435Z\"}},\"principalId\":\"AIDA5MJ3BVHFTE6MUWN4\",\"arn\":\"arn:aws:iam::491827305948:user/stonepass-warden\",\"accountId\":\"491827305948\",\"accessKeyId\":\"AKIAXIDIEXT1LH8NFJV8\"},\"eventTime\":\"2026-07-26T18:37:02.435Z\",\"eventSource\":\"iam.amazonaws.com\",\"eventName\":\"GetUser\",\"awsRegion\":\"us-east-1\",\"sourceIPAddress\":\"10.30.41.118\",\"userAgent\":\"Boto3/1.34.0 md/Botocore#1.34.0 ua/2.0 os/linux#5.15.167.4-lts-hwe md/arch#x86_64 lang/python#3.11.9 md/pyimpl#CPython exec-env/EC2 cfg/retry-mode#standard Botocore/1.34.0\",\"additionalEventData\":{\"SignatureVersion\":\"AWS4-HMAC-SHA256\",\"AuthenticationMethod\":\"AuthHeader\"},\"requestParameters\":{\"path\":\"/\",\"userName\":\"stonepass-warden\",\"action\":\"GetUser\"},\"responseElements\":null,\"requestID\":\"402f202c-0e3d-4b5b-a59b-0c75ddeeb1bd\",\"eventID\":\"f70df636-0b5f-49b2-add3-49b139b6ac9f\",\"readOnly\":true,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"eventCategory\":\"Management\",\"recipientAccountId\":\"491827305948\",\"resources\":[{\"ARN\":\"arn:aws:iam::491827305948:user/stonepass-warden\",\"type\":\"AWS::IAM::User\",\"accountId\":\"491827305948\"}]}"
        },
...........................................

On voit la dernière action faite par l'IP interne avec le user compromis : "sourceIPAddress":"10.30.41.118" user : stonepass-warden -> flag 1 : ListAccessKeys

Flag 2 : Première action faite par l'attaquant : GetTrailStatus

Flag 3 : Action faite par l'attaquant refusée : DeleteTrail -> dans le log, on voit errorCode":"AccessDeniedException","errorMessage":"User is not authorized to perform: cloudtrail:DeleteTrail"

Résultat des flags :

Flag	Réponse
1	ListAccessKeys
2	GetTrailStatus
3	DeleteTrail
4	stonepass-audit-trail-logs
5	stonepass-audit-trail
6	stonepass-warden
7	192.0.2.55
8	StopLogging

← Retour aux writeups