[STACK CTF 2020] Find the leaking bucket
Tags: cybersecurity, cloud, stacktheflags2020
Published: 2020-12-09 17:54:20

<b><u>Introduction</u></b>
This is the write-up(actually a reflection) for the Find the leaking bucket from the team <b>Ov3rWr1t3</b>.

I was excited to see that there was a cloud category when the admins release the categories that are available on discord as I have been doing some research on cloud during my internship and thought this will be a good time for me to test myself on what I know.

<b>However, I did not managed to solve this challenge 😞</b>

<b><u>Challenge Text</u></b>
Find the leaking bucket is a 1000 points cloud challenge.
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/t9aks9jqek9i7x613p03.JPG)
<figcaption>Find the leaking bucket - Challenge Text</figcaption>
****

<b><u>Thought Process</u></b>
After reading the challenge text, we know that the hidden s3 bucket name uses common words related to the company's business and has the word "s4fet3ch" attached at the back.
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/bjzkq0ghclnerius1x4j.JPG)
<figcaption>Safe Online Technologies</figcaption>

Feeling lucky, my first attempt I tried the combination `cybersecurity-smartcity-s4fet3ch` as these seems like the most likely combination for this challenge. 

However, that's not the right combination which was kind of expected. 
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/pczfx8t8wv0p8th1ftxe.JPG)
<figcaption>404 Bucket Not found</figcaption>

Still pumped with the early-stage CTF adrenaline rush, I continued trying out several different combinations manually like a gambling addict trying to figure out his next winning lottery numbers but in my case it was a 2 letter combination which supposed to have a higher rate of getting the right combinations but I guess I wasn't lucky that night and I knew that I spent too much time on manually keying on the combination this is where I decided to change my approach and get a python script to generate a wordlist for the possible combination.

I found a script and modify it and keyed in on the different words.

```
from itertools import permutations

for group in permutations(['safe-', 'online-', 'technologies-', 'digital-', 'data-','parking-','wireless-','data-','information-','architecture-','ai-','technology-','computer-','fintech-','efficiency-','smartcity-','payment-','applications-','cybersecurity-','communication-','systems-','knowledge-','iot-','innovation-','mobile-','analytics-'], 2):
        print(''.join(group)+'s4fet3ch')  

```
I piped the output into a text file and used [bucket_finder](https://digi.ninja/projects/bucket_finder.php) one of the s3 bucket enumeration tools that I found during my internship, but I did not managed to find anything
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/f1oj59suvt1kxx5aris7.jpg)
<figcaption>Where could the bucket be???</figcaption>
At this point, I took a break and when to try other challenges as I felt I spent too much time on this challenge.

I came back to the challenge the next day realizing that I did not the include words from the Steve Job and begin adding the missing words into the script and regenerate a new wordlist for me to enumerate.
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/ovvrxqrwmovp62aal80z.JPG)
<figcaption>Steve Jobs' quote</figcaption>

After generating a new wordlist, I tried using another s3 bucket enumeration tool called [s3scanner](https://github.com/sa7mon/S3Scanner), as this tool has a dump function which allows you to dump all files on any open s3 buckets you find. All you need to do is run the command, `python s3scanner.py -d wordlist.txt`.

At this point of time there were some shell buckets up that other participants created to divert other participants from the real bucket (including me).
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/u9b33zdcl7sjrc4djyzi.JPG)
<figcaption>Not cool man</figcaption>

I managed to find the bucket, however I did not continue as I thought it was one of the shell bucket as the zip file was not dump.
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/h2qir8o73vxrvi3x6465.jpg)

Even though I went to did a manual verification but at the time I think was blocked by AWS and could not access that bucket anymore.
![Alt Text](https://dev-to-uploads.s3.amazonaws.com/i/5y2j18nyxyq7usou9g6k.jpg)
I found out that was the actual bucket after the CTF and was only  able to download it after the CTF was over. To find out how the challenge is solve you can read Matthea Loo's write up on [Medium](https://matthealwe.medium.com/stack-the-flags-2020-3fddc85cb917).


<b><u>Conclusion</u></b>
Even though I did not solve the challenge during CTF, I definitely picked up quite a lot of new things. Thank you for taking your time to read this post.

I would like to thank my team members from<b>(Ov3rwr1t3)</b> for participating the CTF. We will try harder💪💪 for our next CTF!