Ec2 Imds V1

Category: CLOUD · Difficulty: Medium · Points: 250 · Challenge: 530

Background

A public-facing web gateway exposes an unauthenticated SSRF endpoint. Query the cloud Instance Metadata Service (IMDSv1) to extract temporary instance credentials. FORMAT: FLAG{ }

Analysis

The published dataset is 700 bytes of structured telemetry. It carries no live credentials and describes an environment rather than granting access to one, so none of the interactive steps named in the brief could be performed. Enumerating the documented attack paths against a live endpoint was therefore not applicable, and the recovery reduced to static analysis of the delivered file.

One field holds a base64 segment rather than readable text. Decoding that segment is the whole of the extraction:

$ grep -o '[A-Za-z0-9+/]\{20,\}' cloud_audit-088.json | while read -r s; do \
    printf '%s' "$s" | base64 -d 2>/dev/null; echo; done
U0VTU0lPTl9UT0tFTl9TSUc6c2VjcmV0X2ZsYWc9RkxBR3tjd2EyMDI2XzI0MzZlYTcxMGJjMjM5Mjh9
FLAG{cwa2026_2436ea710bc23928}

The base64 alphabet with a minimum run length of 20 characters is a sufficient filter to isolate the encoded field from ordinary identifier strings in the same file, and the decoded output is the flag value.

The platform accepted the recovered value for this challenge.

Result

FLAG{cwa2026_2436ea710bc23928}