Posts

Showing posts from August, 2022

2022 Cloud Village CTF at DEF CON 30 - Multi Cloud Shenanigans

Image
"Clair is a Google Cloud Administrator at PeopleBack Corp in California. Her company has acquired a product and to provide more availability to the customers they had to go multi-cloud setup. The appication is not available to their customer outside California. Can you find the issue and get the content of the site?" Hint PeopleBackCorp recently acquired BeoShaft After the hint was released, I finally had a hit using the Code Search feature on sourcegraph.com for one of the terms relating to the challenge: BeoShaft From there, I browsed directly to https://github.com/BeoShaft and clicked through the small amount of contents in the repo until I saw this image: "Word Art.jpeg" The string " dc5vf5almyxxx " caught my attention right away. At first I thought this may be part of a URL for a lambda function. I crossed checked its length with a function that exists in my personal account and they didn't add up. Even if I removed the X's at the end of the s