write-up - Void Protocols

Void Protocols

write-up

A collection of 13 posts

Pwned Labs - Execute and Identify Credential Abuse in AWS

A public S3 bucket exposed credentials that led to IAM abuse, DynamoDB data exfiltration, cracked passwords, and successful AWS Console access via credential stuffing.

Pwned Labs - Azure Recon with BloodHound

Using compromised Azure credentials, we deploy BloodHound to map the environment and discover role assignments. By enumerating custom security attributes via PowerShell and inspecting VM user data, we uncover hardcoded credentials leading to further access escalation.

Pwned Labs - Abuse Azure Logic App Automation

This lab walks through abusing overshared social media information and insecure Azure Logic App automation to gain initial access, escalate privileges, and compromise an M365 environment.

Pwned Labs - Azure Blob Container to Initial Access

A public Azure Blob container hosting a corporate website exposes versioned files. By enumerating blob versions via the REST API, we discover and retrieve a deleted PowerShell script archive containing hardcoded credentials for both Azure AD and Active Directory admin accounts.

Pwned Labs - Abuse Cognito User and Identity Pools

A public git repository exposes an Android app's source code, revealing misconfigured Cognito pools. Chaining unauthenticated access, user creation, and Lambda SSRF leads to credential extraction and complete AWS compromise of Huge Logistics' cloud environment.

Pwned Labs - Leverage Writable S3 Bucket to Steal Admin Cookie

Compromised SSH credentials provide access to a web server. Discovering a publicly writable S3 bucket hosting frontend assets, we inject malicious JavaScript to steal admin session cookies via XHR requests, achieving session hijacking and accessing sensitive exported data.

Pwned Labs - Uncover Secrets in CodeCommit and Docker

A public Docker image exposes AWS credentials in environment variables. Enumerating CodeCommit with these credentials reveals a dev branch containing hardcoded keys in source code, granting access to an S3 bucket with sensitive data.

Pwned Labs - Bypass Restrictions in API Gateway

Leaked AWS keys enabled API Gateway policy abuse, removal of a prod IP restriction, redeployment, and unauthorized access to the production endpoint.

Pwned Labs - Leverage Insecure Storage and Backups for Profit

AWS credentials expose S3 buckets with SSH keys and EC2 password access. Pivoting via WinRM uncovers credentials leading to AD backups containing NTDS.dit and domain password hashes.

Pwned Labs - Assume Privileged Role with External ID

An exposed config.json file reveals AWS credentials, leading to enumeration of Secrets Manager. By extracting credentials, accessing CloudShell, and exploiting IAM role assumptions with an External ID, we escalate privileges to retrieve Huge Logistics' default payment card details.

Pwned Labs - Pillage Exposed RDS Instances

An exposed RDS MySQL instance is discovered through port scanning. Using Metasploit to brute-force credentials, we gain database access revealing weak passwords and unencrypted PII including customer names, emails, passwords, and credit card numbers stored in plaintext.

Pwned Labs - Plunder Public RDS Snapshots

Using only an AWS account ID, we enumerate public RDS snapshots to discover an exposed Aurora PostgreSQL cluster. By restoring the snapshot, resetting credentials, and accessing via EC2, we extract customer PII including usernames, passwords, and credit card numbers.

Pwned Labs - Abuse S3 Replication and Batch Ops to Exfiltrate Data

Compromised AWS credentials reveal S3 bucket permissions. By modifying S3 replication policies and batch operations, we exfiltrate data to an attacker-controlled bucket. Discovered credentials in the replicated data lead to Secrets Manager access, exposing AWS Organization root account credentials.