【TryHackMe】Advent of Cyber3 (2021)を続けてみた Day17, 18

# Welcome to Advent of Cyber 2021
クリスマスまでの25日間、毎日基本的な知識を学び、初心者向けの新しいセキュリティ演習を行うことで、サイバーセキュリティを始めることができます。

https://tryhackme.com/room/adventofcyber3

# day17
AWSの使い方に関してです。

https://www.youtube.com/watch?v=RAgvdpvKJa0

# Answer
What is the name of the S3 Bucket used to host the HR Website announcement?
<font color="White">images.bestfestivalcompany.com</font>
What is the message left in the flag.txt object from that bucket?
<font color="White">It's easy to get your elves data when you leave it so easy to find!</font>
What other file in that bucket looks interesting to you?
<font color="White">wp-backup.zip</font>
What is the AWS Access Key ID in that file?
<font color="White">AKIAQI52OJVCPZXFYAOI</font>
What is the AWS Account ID that access-key works for?
<font color="White">019181489476</font>
What is the Username for that access-key?
<font color="White">ELFMcHR@bfc.com</font>
There is an EC2 Instance in this account. Under the TAGs, what is the Name of the instance?
<font color="White">HR-Portal</font>
What is the database password stored in Secrets Manager?
<font color="White">Winter2021!</font>

# day18
dockerに関してです。基本的な操作に関しては私の過去の記事をご参照ください。

https://qiita.com/hoglet/items/8b5659b137ab428d818f

まず、GrinchEnterprisesイメージを取得できます。

```s
┌──(kali㉿kali)-[~]
└─$ sudo docker pull public.ecr.aws/h0w1j9u3/grinch-aoc:latest                                                                       
latest: Pulling from h0w1j9u3/grinch-aoc
7b1a6ab2e44d: Pull complete 
7181c3c4941b: Pull complete 
148b30b9ae2d: Pull complete 
6f5a7c388565: Pull complete 
ef099323cb4a: Pull complete 
de5bf7e2abf0: Pull complete 
455d5424d859: Pull complete 
b1ee65a7e02a: Pull complete 
a47021107475: Pull complete 
Digest: sha256:593c79eaaa1a905c533e389b0034022e074969da3936df648172c4efc8d421d8
Status: Downloaded newer image for public.ecr.aws/h0w1j9u3/grinch-aoc:latest
public.ecr.aws/h0w1j9u3/grinch-aoc:latest
```

imagesを確認します。

```s
┌──(kali㉿kali)-[~]
└─$ docker images                                        
REPOSITORY                           TAG          IMAGE ID       CREATED        SIZE
public.ecr.aws/h0w1j9u3/grinch-aoc   latest       f886f0052070   8 weeks ago    508MB
```

次のコマンドを実行して、コンテナーを実行し、コンテナーと対話できます。

```s
┌──(kali㉿kali)-[~]
└─$ docker run -it public.ecr.aws/h0w1j9u3/grinch-aoc:latest
$ ls -la
total 20
drwxr-xr-x 2 newuser newuser 4096 Oct 21 20:31 .
drwxr-xr-x 1 root    root    4096 Oct 21 20:31 ..
-rw-r--r-- 1 newuser newuser  220 Feb 25  2020 .bash_logout
-rw-r--r-- 1 newuser newuser 3771 Feb 25  2020 .bashrc
-rw-r--r-- 1 newuser newuser  807 Feb 25  2020 .profile
```
Linuxでは(特にコンテナーの場合)、環境変数を使用して、実行時にコンテナーを構成するために使用されるシークレットやその他の機密情報を格納できます。

```s
$ printenv
HOSTNAME=4c43670fb3d7
HOME=/home/newuser
TERM=xterm
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
api_key=a90eac086fd049ab9a08374f65d1e977
PWD=/home/newuser
```

コンテナイメージを.tarファイルとして保存します。

```s
┌──(kali㉿kali)-[~]
└─$ docker save -o aoc.tar public.ecr.aws/h0w1j9u3/grinch-aoc:latest
```

「jq」と呼ばれるツールを使用してこの画像を見て、読みやすくするために出力を「きれいに印刷」してみましょう。
`apt install jq -y`

jqを使用してmanifest.jsonの内容を端末に出力し、次のようにきれいに印刷します。 
`cat manifest.json | jq`

```s
┌──(kali㉿kali)-[~]
└─$ cat manifest.json | jq                                                                              
[
  {
    "Config": "f886f00520700e2ddd74a14856fcc07a360c819b4cea8cee8be83d4de01e9787.json",
    "RepoTags": [
      "public.ecr.aws/h0w1j9u3/grinch-aoc:latest"
    ],
    "Layers": [
      "7fefb4d8c3c80e1f3bc9dc7344e11f56a556ba48910d9dd9017a9330524c0d4a/layer.tar",
      "26706174e7a019bacd096a9d6423f368dd12b37324aec94636780e1c1fe98745/layer.tar",
      "e01bbbeae3789a6b0542ac56387f316c9a3d9c479880808e68290c473887ce70/layer.tar",
      "463457e75fa5a4311debb96f7294e3eba0666c3d2a5e8bf9da48a9c1a8649bad/layer.tar",
      "ef4cece76405cb3d37b749ef41414915e35bed0098868d5399856e1769923757/layer.tar",
      "8166aab5c056bbadf0250d9d39bf1ed78c88e20b9ef331c64871de7ca190c5fe/layer.tar",
      "88d668cd0709095fe76abfb6448913e54dccc3913f3c125387b2bb4368cde143/layer.tar",
      "0146979db5cfca4fc9b0ccf1b2ada74dea9189b08565e562cb2d343d83d55f30/layer.tar",
      "bc66ed1ea19032df937dd3d6f9a46370c1d8973b15710871c1af4d277109ec82/layer.tar"
    ]
  }
]
```


# Answer
What command will list container images stored in your local container registry?
<font color="White">docker images</font>
What command will allow you to save a docker image as a tar archive?
<font color="White">docker save</font>
What is the name of the file (including file extension) for the configuration, repository tags, and layer hash values stored in a container image?
<font color="White">manifest.json</font>
What is the token value you found for the bonus challenge?
<font color="White">7095b3e9300542edadbc2dd558ac11fa</font>