Uncover Secrets in CodeCommit and Docker

This beginner-friendly lab highlights the common problem of leaked credentials in public Docker images. You discover and pull a company image from Docker Hub, extract hardcoded AWS keys from its environment variables, then pivot into AWS CodeCommit to reconstruct commit history and recover a second set of keys leading to sensitive S3 data.

Huge Logistics has engaged your team to scrutinize their public repositories for overlooked credentials, then use anything found to gain initial access and demonstrate lateral and vertical movement in their cloud.

• Basic Linux command line knowledge
• Docker installed with a Docker Hub account
• AWS CLI installed

• Search, inspect, and pull Docker Hub images and review tags with the registry API and jq
• Analyze an image with Docker Scout for base distribution and known CVEs
• Extract hardcoded AWS keys from container environment variables using env and docker inspect
• Enumerate AWS permissions with aws-enumerator to discover CodeCommit access
• Enumerate CodeCommit repositories, branches, commits, and differences with the AWS CLI
• Recover a base64 encoded source file to extract leaked AWS keys and pivot to an S3 bucket
• Scan images and git repositories for secrets using Trufflehog and prevent leaks with git-secrets

Docker Hub hosts millions of public images, and an RWTH Aachen study of over 337,000 images found that more than 8 percent contained confidential data, including thousands of private keys and cloud API secrets.