This document announces a workshop on attacking AWS hosted by Pawel Rzepa. The workshop will include two hands-on labs: the first explores vulnerabilities in the S3 storage service by detecting and accessing a publicly available S3 bucket, and the second involves deploying a lab environment on EC2 to practice privilege escalation. Participants need an AWS account and basic AWS knowledge. The workshop is free and will be held on December 17th in Wroclaw, Poland, with both in-person and remote participation options.

1. www.securing.pl
Pawel Rzepa (@Rzepsky)
ATTACKING AWS
workshop

2. www.securing.pl
Prerequisites
• What do you need to have to participate in this workshop?
• AWS account
• Basic understanding of AWS
• SSH client
• And… good mood 
• During the workshop you’ll deploy the lab machine – all required stuff is there ;)
• I’ll share the presentation with all step-by-step instructions – you’ll be able to go
through all the steps after the workshop!

3. www.securing.pl
Agenda
• Preparing the lab
• Vulnerabilities in S3 service - KrkAnalytica challenge
• Privilege escalation (via EC2)
• Clean the environment

4. www.securing.plwww.securing.pl
LAB 1: VULNERABILITIES IN S3
SERVICE

5. www.securing.pl
What we gonna do in this lab?
• We’ll go through some theory of the problem and why this stuff is so important
• Detect publicly available KrkAnalytica bucket
• Explore the bucket’s content to find the public snapshot ID
• Mount the snapshot and explore its content
• Find the secret!

6. www.securing.plwww.securing.pl
LAB 2: PRIVILEGE ESCALATION
(VIA EC2)

7. www.securing.pl
What we gonna do?
• Deploy the lab (new account + EC2 instance)
• Enumerate permissions
• Attack!

8. www.securing.pl
Passwords vs Keys
Access key ID =
AKIAJIS2NP37SW1AYBHA
Secret access key =
nTRcofv3N9ls6MqFhsR8lxQp+
NfoDv+2lXzv9nT
Login = admin
Password = Dupa.8 VS
New
User
Data
www.securing.biz

9. www.securing.pl
Interested?
• Join OWASP Meetup on 17th December in EY GDS building (address: Sucha 2, 50-
086 Wroclaw) at 18:00.
-> https://www.meetup.com/owasp-poland/events/266995301/
• Participation in the workshop is for free!!!
• Labs are hands-on – that’s the best way to learn and have a good time, but sits
for people with laptops are limited, so please send me an email on
pawel.rzepa@owasp.org, that you want to bring your own laptop!
• If you want to just listen – no problem, you’re very welcome to join us!
• Sooo… Can’t wait to see you there!