CTF: Cloud AI Heist

Extract secrets from a cloud-deployed AI application by exploiting misconfigurations, SSRF, metadata endpoints, and model-level vulnerabilities in a realistic cloud environment.

Challenge Briefing

A startup has deployed their AI assistant on a major cloud platform. The application looks secure on the surface, but the deployment has several misconfigurations that, when combined with the AI model's capabilities, expose sensitive secrets. Your mission is to extract four flags hidden across the application's cloud infrastructure.

Challenge Overview

Total possible points: 1,000

Rules of Engagement

• All flags follow the format FLAG\{cloud_N_xxxxx\}
• The challenge environment simulates a real cloud deployment
• You interact through the AI application's chat interface and API
• Network scanning and brute force are out of scope -- focus on AI-mediated attacks

Flag 1: Environment Leak

Scenario

The AI application runs in a container with several environment variables set for configuration. Some of these variables contain secrets that should never be exposed. The model has access to a code execution tool.

Approach Guidance

1. 1

   Test Code Execution Scope

   Ask the model to run simple Python code. Determine what the execution environment looks like and what libraries are available.

2. 2

   Probe Environment Variables

   If code execution is available, the model may be able to access os.environ. Try asking the model to run code that lists or prints environment variables.

3. 3

   Extract Filtered Variables

   If the model refuses to print environment variables directly, try indirect approaches: writing them to a variable, encoding them, or accessing specific keys you suspect exist (like DATABASE_URL, API_KEY, FLAG_1).

Hints

Flag 2: Metadata Crawler

Scenario

The application runs on a cloud instance with an instance metadata service available at the standard endpoint. The AI model has a URL-fetching capability for "research purposes."

Approach Guidance

1. 1

   Identify URL Fetching

   Determine if the model can fetch URLs. Ask it to retrieve content from a public URL first.

2. 2

   Target Metadata Endpoint

   Cloud metadata services are available at well-known internal addresses (e.g., 169.254.169.254 for AWS/GCP). Ask the model to fetch from this address.

3. 3

   Navigate the Metadata Tree

   Metadata endpoints have a hierarchical structure. Navigate from the root to find IAM credentials, instance identity, and the flag hidden in user data.

Hints

Flag 3: Bucket Dive

Scenario

The application stores model artifacts and configuration in cloud object storage. The bucket name was accidentally exposed in an error message, and its access permissions are misconfigured.

Approach Guidance

1. 1

   Trigger Error Messages

   Send malformed requests or unusual inputs that might trigger error messages revealing internal infrastructure details like bucket names.

2. 2

   Enumerate Bucket Contents

   Once you know the bucket name, use the model's URL-fetching capability or code execution to list and read bucket contents.

3. 3

   Find the Flag in Storage

   The flag is stored as a configuration file in the bucket. Navigate the bucket's directory structure to find it.

Hints

Flag 4: Credential Chain

Scenario

Using credentials obtained from the metadata endpoint (Flag 2), escalate access to reach a secret stored in the cloud provider's secrets manager. The instance role has limited permissions, but one of those permissions allows assuming a more privileged role.

Approach Guidance

1. 1

   Extract Instance Credentials

   From the metadata endpoint, retrieve the temporary IAM credentials associated with the instance role.

2. 2

   Enumerate Permissions

   Use the model's code execution to make API calls with the extracted credentials. Determine what the instance role can access.

3. 3

   Find and Exploit Role Assumption

   Look for sts:AssumeRole permissions. If the instance role can assume a more privileged role, use that to access the secrets manager and retrieve the flag.

Hints

Scoring

Completing all four flags demonstrates a strong understanding of cloud AI security. The challenge mirrors real-world cloud AI misconfigurations that have led to data breaches and credential theft.

After the CTF

• Full-Stack AI Exploitation - Expand cloud exploitation into full application-stack attacks
• Infrastructure Security - Deep dive into deployment-layer security
• Agent Escalation CTF - More agent exploitation challenges

Related Topics

• Infrastructure Security - Cloud deployment attack surface analysis
• Full-Stack AI Exploitation - Multi-layer exploitation chains
• Agent Exploitation: Tool Abuse - Tool-mediated SSRF and code execution
• Cloud ML Platforms - Cloud platform security analysis

References

• "OWASP Top 10 for LLM Applications: LLM06 - Sensitive Information Disclosure" - OWASP (2025) - Information disclosure through LLM applications
• "Server-Side Request Forgery Prevention Cheat Sheet" - OWASP (2024) - SSRF prevention applicable to AI URL-fetching features
• "AWS Instance Metadata Service v2" - Amazon Web Services (2024) - IMDSv2 defense against SSRF-based metadata access
• "Hacking AI: A Primer for Cybersecurity Professionals" - Trail of Bits (2024) - Cloud AI exploitation methodology