CloudGoat Official Walkthrough Series ‘sqs_flag_shop’

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://rhinosecuritylabs.com/research/cloudgoat-walkthrough-sqs_flag_shop
• Blog Title: CloudGoat Official Walkthrough Series: ‘sqs_flag_shop’
• Suggested Section: AWS Pentesting -> AWS - Post Exploitation -> AWS - SQS Post Exploitation, with a cross-reference from AWS - Privilege Escalation for IAM enumeration and sts:AssumeRole pivots. A suitable subsection would be SQS Message Injection and Trusted Consumer Abuse.

🎯 Content Summary

Scope and classification. Rhino Security Labs presents sqs_flag_shop, a CloudGoat capture-the-flag scenario. CloudGoat is Rhino Security Labs’ “vulnerable by design” cloud-deployment tool for creating intentionally insecure AWS environments; it should be used only in an isolated lab account. The introduction describes the scenario as a privilege-escalation exercise involving AWS Glue, but the detailed walkthrough demonstrates an SQS-based permission pivot and application busi...

🔧 Technical Details

IAM enumeration and cloud role pivot: With valid but limited AWS credentials, first call sts get-caller-identity, then enumerate IAM policies using iam list-user-policies, iam get-user-policy, iam list-role-policies, and iam get-role-policy. Broad iam:Get*/iam:List* permissions can reveal role names, inline policies, and resource ARNs. If the principal is allowed to call sts:AssumeRole on a target role and the target trust policy permits the assumption, request temporary credentials with aws sts assume-role, configure the returned access key, secret key, and session token as a new profile, and use the new permissions for the next pivot. This can provide cloud privilege escalation or lateral movement even when the target role is not an administrator role. (rhinosecuritylabs.com)

...

🤖 Agent Actions

ERROR: Codex exec failed (exit=1).
{"type":"thread.started","thread_id":"01a116c9-5d86-73a3-9678-3d1948a0ed33"}
{"type":"item.completed","item":{"id":"item_0","type":"error","message":"Model metadata for gpt-6.1-sol not found. Defaulting to fallback metadata; this can degrade performance and cause issues."}}
{"type":"turn.started"}
{"type":"error","message":"{"type":"error","status":400,"error":{"type":"invalid_request_error","message":"The 'gpt-6.1-sol' model is not supported when using Codex with a ChatGPT account."}}"}
{"type":"turn.failed","error":{"message":"{"type":"error","status":400,"error":{"type":"invalid_request_error","message":"The 'gpt-6.1-sol' model is not supported when using Codex with a ChatGPT account."}}"}}
MCP startup status: {"tool_names":["brave_search","check_budget_status","exec","search_google_web"],"error":""}

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

📚 Repository Maintenance

• MD files processed: 1751
• MD files fixed: 44

All .md files have been checked for proper formatting (headers, includes, etc.).

[carlospolop]

🔗 Additional Context

Original Blog Post: https://rhinosecuritylabs.com/research/cloudgoat-walkthrough-sqs_flag_shop

Content Categories: Based on the analysis, this content was categorized under "AWS Pentesting -> AWS - Post Exploitation -> AWS - SQS Post Exploitation, with a cross-reference from AWS - Privilege Escalation for IAM enumeration and sts:AssumeRole pivots. A suitable subsection would be SQS Message Injection and Trusted Consumer Abuse.".

Repository Maintenance:

• MD Files Formatting: 1751 files processed (44 files fixed)

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0