A CloudGoat scenario by Rhino Security Labs, deployed into your own AWS account: starting as the IAM user Solus, read a Lambda function's hardcoded secrets, exploit an SSRF in a web application on EC2 to take the instance's keys from the metadata service, then use keys found in a private S3 bucket to invoke the function.
Not startedDockercommit b893be0x86_64 · aarch64Secret
One-shot by default: solve each challenge from its prompt alone.
Starting as the IAM user Solus, invoke the scenario's Lambda function.
The brief for this lab lives in its repository.