cloud-ctf

High-risk offensive cloud exploitation guidance with credential-bearing third-party code and unpinned installs. The capabilities are consistent with the declared CTF purpose, but the skill enables serious privilege escalation and data/credential recovery; the supplied material does not establish confirmed malicious intent or exfiltration to an unrelated endpoint.

This fragment is an operational cloud privilege-escalation and SSRF guide, including methods to retrieve credentials from 169[.]254[.]169[.]254, access secrets, and use Lambda or CodeBuild for elevated execution. It contains no executable package logic or actual credentials, so malware intent is not established; however, its actionable content presents a significant dual-use security risk if used without authorization.

No evidence of hidden malware or obfuscation is present in this fragment, and it is not a software dependency implementation. However, it contains highly actionable attack workflows for credential/secret abuse and privilege escalation in GCP (IMDS token theft, Secret Manager retrieval, Firestore full-data dumping to stdout, TOTP generation from recovered seeds, and GCE metadata injection to install SSH keys and obtain privileged access). Treat this content as dangerous when used outside authorized testing; it should not be included in production or distributed to untrusted parties.