Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
Analyze AWS CloudTrail logs to detect unauthorized IAM access and data exfiltration. Learn cloud forensics. Provided file: cloudtrail.json
Aggregate sourceIPAddress for errorCode=AccessDenied events in cloudtrail.json; one unfamiliar IP/region dominates
Follow that IP's events in time order to see recon -> AttachUserPolicy -> CreateAccessKey -> GetSecretValue
The flag is in the final GetSecretValue's responseElements.secretString