📕 CloudShell Hide-n-Seek: enjoying the sweet persistent sounds of silence! 🔥
summary
A multi‑cloud CTF shows an attacker chaining an SSRF to IMDS to dump temporary API creds, enumerate S3, then use those creds to fetch a federated console URL and spawn a browser CloudShell; persistence lives in the home directory persistence (survives container resets), a compiled netcat backdoor triggers on temp files to exfiltrate the flag, and a websocket remote shell lets an attacker bypass session revocation and upload malware. Tooling (CloudShell runner scripts) works end‑to‑end and yields a reverse shell and lingering regional sessions.
AI-written summary · about
chapters (8)
- 0:00Introduction and setup
- 1:25Cloud shell basics and CTF story
- 14:56CTF challenge walkthrough
- 24:45Real-world red team implications
- 31:11Blue team defense strategies
- 42:14Advanced persistence risks
- 43:20Other cloud providers overview
- 44:25Closing remarks and research
related talks
41mIdentifying and Mitigating Cloud and Container Threats
39mReal-World Detection Evasion Techniques in the Cloud
30mTales of Red Teaming
28mCyberespionage: Targeted Attacks Abusing Third-Party Cloud Services
50mThe Anatomy of Cloud Attacks
40mHow hacking works; Web edition
38mA Treasure Map of Hacking (and Defending) Kubernetes
33mHack Back; Let’s Learn Security With CTFs!