# Level 6

The welcome page for Level 6 provides us with credentials to an AWS account. This account has the [SecurityAudit](https://docs.aws.amazon.com/aws-managed-policy/latest/reference/SecurityAudit.html) policy attached to it. This policy allows a user to read security configuration metadata. These credentials can be used to create a new profile.

To find out more about this IAM user, we can begin with some enumeration. ``` aws sts get-caller-identity --profile flaws6 ```

Using the `aws iam list-policies` command, we can see what other policies are applied. One of note is the Lambda execution policy. We’ll keep this in mind for later. ``` aws iam list-policies --profile flaws6 ```

Next, let’s see what policies are attached to the user. ``` aws --profile flaws6 iam list-attached-user-policies --user-name Level6 ```

The "list-apigateways" policy is interesting especially since it is custom. ``` aws --profile flaws6 iam get-policy --policy-arn arn:aws:iam::975426262029:policy/list_apigateways ```

We can dive deeper into this policy by using ARN. By doing so, we see that it is using a GET request on the resource “arn:aws:apigateway:us-west-2::/restapis/\* ``` aws --profile flaws6 iam get-policy-version --policy-arn arn:aws:iam::975426262029:policy/list_apigateways --version-id v4 ```

Remember when we saw the Lambda execution policy earlier? Let’s list the Lambda functions for this account and see what we find. We can see that there is a Level 6 function. ``` aws --region us-west-2 --profile flaws6 lambda list-functions ```

To dig deeper, we can use the lambda get-policy command to retrieve information about this policy. This shows us that the Principal is allowed to execute this function. It also shows us the rest-api-id "s33ppypa75" ``` aws --region us-west-2 --profile flaws6 lambda get-policy --function-name Level6 ```

Now we can use that ID to query the apigateway. This shows us the stageName is Prod. ``` aws --profile flaws6--region us-west-2 apigateway get-stages --rest-api-id "s33ppypa75" ```

After reviewing AWS [documentation](https://docs.aws.amazon.com/apigateway/latest/developerguide/apigateway-private-api-test-invoke-url.html), we can use that information gathered to hit the endpoint. Note: this is the structure `https://[apigateway].execute-api.[region].amazonaws.com/[stagename]/[functionname]` ``` https://s33ppypa75.execute-api.us-west-2.amazonaws.com/Prod/level6 ```

When we visit the URL, we are greeted with The End!