Reading Time: 3 minutes

In the post, i would like to share some knowledge on Cloud Penetration Testing for learning purposes

What is Cloud Penetration Testing?

There are some Penetration Testing that has been executed within the organization and one of them is Cloud Penetration Testing Activity. It is an activity that has been designed so that the tester will access the strength and weaknesses of any application that resides inside the cloud system.

The main purpose for the activity are such as follows:

• Identify risks, vulnerabilities, and gaps
• Impact of exploitable vulnerabilities
• Determine how to leverage any access obtained via exploitation
• Deliver clear and actionable remediation information
• Provide best practices in maintaining visibility

Demonstration on the Cloud Penetration Testing

The writeup is taken from here for those who are willing to read further on the process

Now, we know that system is using Amazon Web Services or also known as AWS.

Tools use: Installing AWScli

We need to install AWScli in order to play with the machine.

We will execute the command sudo apt update && apt install awscli

AWS Configurations

Now we can try to gain access to the machine via reverse shell.

Before we can get the reverse shell, it is required to setup the AWS configuration.

We don’t have to key-in the real key because this is for HTB room purposes.

We can run the command aws dynamodb list-tables –endpoint-url http://s3.bucket.htb

Oh, wait! We got an error with the command and we found out that the command will need to execute with root privilege.

Therefore, we need to know any available tables in the machine and we found nothing.

We don’t have any use for that information for now. But we will come back here when needed later on.

aws –endpoint-url http://s3.bucket.htb. s3 ls

When we execute the command sudo aws –endpoint-url http://s3.bucket.htb. s3 ls, we did notice that adserver directory is there for some reason.

Let’s check what has been stored in that directory by executing sudo aws –endpoint-url http://s3.bucket.htb. s3 ls s3://adserver

There’s a website file such as index.html stored in the directory. I have been thinking that maybe we can upload any file into the directory.

Let’s upload the PHP reverse shell inside.

I have modified the name of the file and we are set with the PHP reverse shell.

We have successfully uploaded the shell into the AWS environment.