Operation Broken Chain

LONG · LINUX · difficulty 5 · ~80 min · 29 steps

Nothing was exploited. Every component did exactly what it was documented to do, and the data left anyway.

Briefing

09:04. Your object-storage bill has a spike in it: 4.1 terabytes of egress from a bucket that normally serves nothing, over eleven hours overnight. The bucket is fine. The permissions are fine. The role that read it is one of yours, it was assumed legitimately, and the cloud provider's logs will show a completely ordinary sequence of API calls. This is going to take you backwards through six systems that no single team owns, and at every hop the previous hop will look legitimate. Nothing here is an exploit. Follow the chain to the beginning and find the default nobody chose.

Objectives

• Establish what read the data, and under which identity
• Trace that identity back to the workload that assumed it
• Identify the image the workload was running, and how it got there
• Prove where the image came from and what it contains
• Find the credential that pushed it, and where it was published
• Contain across every layer, then hand over an honest report

Return to the range lobby