[Retired] Cloud Security CTF: Serverless Edition: [Nov 6-10]

This CTF contest has concluded. The compressed solution PDF manual can be downloaded from above.

If you face difficulty in viewing the images in the compressed PDF manual, download High-Quality solution PDF manual from here.

Welcome to our Weekly CTF Contest!

CTF Description: 

With serverless computing, the developers no longer have to worry about servers. The infrastructure management tasks like capacity provisioning, patching, etc. are handled by the cloud service provider allowing developers to focus only on writing the code.

Functions and events are the core components of serverless computing. When an event happens, a function is triggered and the code gets executed. 

AWS Lambda is the serverless computing platform provided by Amazon. Lambda functions are stateless allowing Amazon to launch as many copies of the function as needed for scaling. 

Serverless architecture is said to be more secure compared to traditional architectures. However, this does not mean that attacks cannot be performed on it. This CTF is focused on services such as AWS Lambda, API Gateway, and how a vulnerable Lambda function can be leveraged to perform operations that the user is not allowed to do.

Objective:

Collect all 7 FLAGs named: ServerlessFLAG1, ServerlessFLAG2, ServerlessFLAG3, ServerlessFLAG4 (Resource ARN), ServerlessFLAG5, ServerlessFLAG6 (Version) and ServerlessFLAG.

There could be other FLAG names in the same environment hence we have mentioned the specific flag names above.

Level:

Intermediate.

Instructions:

• Click on RUN to start the lab (takes approximately 25s).

• Click on LAB LINK to view the Access Key Id and Secret Key of a read-only user account.

• Interact with API Gateway, AWS Lambda, and recover seven flags. 

• Apart from ServerlessFLAG4 and ServerlessFLAG6, the flags are named as ServerlessFLAG1, ServerlessFLAG2, ServerlessFLAG3, ServerlessFLAG5 and ServerlessFLAG7

• ServerlessFLAG4 is ARN of the event source which triggers "Monitor" Lambda function

• ServerlessFLAG6 is the version of the package used by the "FileUploader" Lambda function.
  
  

Rules:

• Collect all 7 FLAGs named: ServerlessFLAG1, ServerlessFLAG2, ServerlessFLAG3, ServerlessFLAG4 (Resource ARN), ServerlessFLAG5, ServerlessFLAG6 (Version) and ServerlessFLAG7

• Once you verify the flags, email attackdefense@pentesteracademy.com with a short report on the process and the email you used to register on this website.

• Reply to our Twitter posts to let us know you've submitted your report. 

• This CTF contest will start on 0000hrs Nov 06, 2020 ET and end on 2359hrs Nov 10, 2020 ET.

• The first person to capture all the flags gets a Raspberry Pi 400 + 1-month subscription + Pentester Academy T-shirt

• Second and third to capture all the flags will get a 1-month subscription + Pentester Academy T-shirt

• 3 other participants who capture all the flags will be selected randomly to win 1-month subscriptions! These will be picked randomly from the remaining correct submissions coming in upto 2359hrs Nov 10, 2020 ET

• Winners will be contacted on Nov 11-12, 2020

• All decisions from our team will be final.