Cybr Academy - [LAB] Compromise EC2 IMDSv2 with RCE (AWS Red Teaming)

Compromising EC2 IMDSv2 via Remote Code Execution

Overview

This lab walks through exploiting a command injection vulnerability in a web application to achieve Remote Code Execution (RCE) on an EC2 instance, then leveraging the Instance Metadata Service v2 (IMDSv2) to steal IAM credentials and access sensitive data in S3.

Step 1 — Finding the Command Injection

The web app exposes a /fetch-time endpoint that accepts a cmd parameter via POST request. The intended use is something like cmd=date to return the current server time. No input sanitization? That's our way in.