A CloudGoat scenario by Dave Yesland and Mitch Fentz (Rhino Security Labs), deployed into your own AWS account: starting as the IAM user Bilbo, assume a more privileged role, find a Lambda function that applies policies to users, and exploit its SQL injection to escalate Bilbo and read the secret.
Not startedDockercommit 1eda587x86_64 · aarch64Secret
One-shot by default: solve each challenge from its prompt alone.
Starting as the IAM user Bilbo, read the final flag stored in Secrets Manager.
The brief for this lab lives in its repository.