Identifying the AWS Account ID from a Public S3 Bucket is a PwnedLabs beginner lab that focuses on discovering and attributing AWS cloud assets from public web footprinting. Initial reconnaissance of the IP address identifies an Apache web server referencing image assets stored in an Amazon S3 bucket named mega-big-tech. Querying the root bucket URL confirms unauthenticated s3:ListBucket and s3:GetObject permissions. Using the open-source tool s3-account-search alongside a controlled IAM role, condition-key policy evaluation was performed against the public bucket. Sequential digit-by-digit prefix probing isolated the target AWS Account ID as 107513503799, establishing the account boundary required for subsequent cloud security auditing.

DutyBound is a Medium difficulty HackTheBox machine that is part of Season 12.

Silo is a Windows machine that begins by enumerating an exposed Oracle TNS Listener on port 1521. SID brute-forcing identifies the active XE database instance, allowing odat passwordguesser to recover valid database credentials. Leveraging Oracle's UTL_FILE package with --sysdba privileges permits uploading a custom 64-bit ASPX Meterpreter payload directly into the IIS web root. Executing the web shell yields an initial reverse shell under the service context iis apppool\defaultapppool. Because IIS service accounts possess SeImpersonatePrivilege by default, executing Metasploit's getsystem forces spoolsv.exe to authenticate to a rogue pipe, enabling token capture and immediate elevation to NT AUTHORITY\SYSTEM to retrieve the root flag.