Pearson's OSCP Notebook

AWS CLI

Properties1
tagsaws, aws-cli, s3, minio, cloud, bucket, endpoint-url, configure, oscp

4 min read

AWS CLI — Complete OSCP Reference

What is the AWS CLI?

Command-line interface for Amazon Web Services. On pentests and HTB, targets often run MinIO or S3-compatible storage on a custom port — you use the same aws s3 commands with --endpoint-url instead of real AWS.

OSCP / HTB use: Find creds in web app, config, or env vars → aws configure → list buckets → download sensitive files (backups, .env, SSH keys).

Install: sudo apt install awscli or pip install awscli

📌 1) Configure Credentials

Interactive setup

aws configure
# AWS Access Key ID:     AKIA...
# AWS Secret Access Key: ...
# Default region:        us-east-1
# Default output format: json

Named profile (HTB pattern)

aws configure --profile facts
# Enter access key, secret, region, output format

Use profile on every command:

aws --profile facts s3 ls
aws --profile facts --endpoint-url=http://facts.htb:54321 s3 ls

Manual credentials file

# ~/.aws/credentials
[facts]
aws_access_key_id = AKIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
 
# ~/.aws/config
[profile facts]
region = us-east-1
output = json

Environment variables (no profile file)

export AWS_ACCESS_KEY_ID=AKIA...
export AWS_SECRET_ACCESS_KEY=...
export AWS_DEFAULT_REGION=us-east-1
aws s3 ls --endpoint-url=http://TARGET:54321

Verify identity

aws sts get-caller-identity
aws sts get-caller-identity --profile facts --endpoint-url=http://facts.htb:54321

📌 2) Custom Endpoint (MinIO / HTB / Local S3)

Real AWS uses default endpoints. Lab boxes use custom URL:

export ENDPOINT=http://facts.htb:54321
 
aws --profile facts --endpoint-url=$ENDPOINT s3 ls
aws --profile facts --endpoint-url=http://10.10.11.25:9000 s3 ls
FlagDescription
--endpoint-url URLS3-compatible API base URL (required for MinIO/HTB)
--profile NAMEUse named profile from aws configure
--region REGIONRegion (often required even with custom endpoint)
--no-verify-sslSkip TLS verification (self-signed HTTPS)
--no-sign-requestAnonymous access (public buckets)

Add to /etc/hosts if using hostname:

echo "10.10.11.25 facts.htb" | sudo tee -a /etc/hosts

📌 3) S3 — List & Enumerate

# List all buckets
aws --profile facts --endpoint-url=http://facts.htb:54321 s3 ls
 
# List objects in bucket
aws --profile facts --endpoint-url=$ENDPOINT s3 ls s3://bucket-name
aws --profile facts --endpoint-url=$ENDPOINT s3 ls s3://bucket-name/ --recursive
aws --profile facts --endpoint-url=$ENDPOINT s3 ls s3://bucket-name/prefix/ --recursive
 
# Human-readable sizes + summary
aws --profile facts --endpoint-url=$ENDPOINT s3 ls s3://bucket --recursive --human-readable --summarize
s3 ls flagDescription
--recursiveList all objects under prefix
--summarizeTotal objects + size at end
--human-readableHuman sizes
--page-size NPagination size

📌 4) S3 — Download (cp / sync)

# Download single file
aws --profile facts --endpoint-url=http://facts.htb:54321 \
  s3 cp s3://bucket-name/path/to/file.txt ./file.txt
 
# Download entire bucket/prefix
aws --profile facts --endpoint-url=$ENDPOINT \
  s3 cp s3://bucket-name/ ./loot/ --recursive
 
# Sync (mirror — skip existing)
aws --profile facts --endpoint-url=$ENDPOINT \
  s3 sync s3://bucket-name/ ./loot/
s3 cp / sync flagDescription
--recursiveCopy directory tree
--exclude PATTERNExclude files
--include PATTERNInclude files
--quietLess output
--only-show-errorsErrors only
--request-payer requesterRequester-pays buckets

HTB example:

aws --profile facts --endpoint-url=http://facts.htb:54321 \
  s3 cp s3://facts-backup/database.sql ./database.sql
 
aws --profile facts --endpoint-url=http://facts.htb:54321 \
  s3 sync s3://facts-backup/ ./loot/ --recursive

📌 5) S3 — Upload / Write (if creds allow)

aws --profile facts --endpoint-url=$ENDPOINT s3 cp shell.php s3://bucket/shell.php
aws --profile facts --endpoint-url=$ENDPOINT s3 cp ./file s3://bucket/ --recursive

📌 6) S3 — Other Commands

# Bucket ACL / policy (if permitted)
aws --endpoint-url=$ENDPOINT s3api get-bucket-acl --bucket BUCKET
aws --endpoint-url=$ENDPOINT s3api get-bucket-policy --bucket BUCKET
aws --endpoint-url=$ENDPOINT s3api list-objects-v2 --bucket BUCKET
 
# Presigned URL (sometimes in apps)
aws s3 presign s3://bucket/file --expires-in 3600

📌 7) Global AWS CLI Flags

Apply to most aws subcommands:

FlagDescription
--profile NAMENamed credentials profile
--region REGIONAWS region
--endpoint-url URLCustom API endpoint
--output json|text|tableOutput format
--query QUERYJMESPath filter
--no-verify-sslDisable SSL verify
--no-sign-requestUnsigned (anonymous)
--debugDebug HTTP requests
--cli-read-timeout SECRead timeout
--cli-connect-timeout SECConnect timeout

JMESPath query examples

aws s3api list-objects-v2 --bucket BUCKET --endpoint-url=$ENDPOINT \
  --query 'Contents[].Key' --output text
 
aws sts get-caller-identity --query Account --output text

📌 8) Finding AWS Creds on Box

# Linux
grep -rniE "aws_access|aws_secret|AKIA" /var/www /home 2>/dev/null
env | grep -i aws
cat ~/.aws/credentials 2>/dev/null
 
# Config files
find / -name "credentials" -o -name "config" 2>/dev/null | xargs grep -l aws 2>/dev/null

Windows: web.config, .env, IIS configs, environment variables.

📌 9) MinIO Client (alternative)

Some boxes use mc instead of aws:

mc alias set htb http://facts.htb:54321 ACCESSKEY SECRETKEY
mc ls htb
mc cp htb/bucket/file ./file

📌 10) OSCP Workflow

1. Find AKIA... + secret in app/config/env
2. aws configure --profile target
3. Add /etc/hosts if hostname used
4. aws --profile target --endpoint-url=http://HOST:PORT s3 ls
5. aws ... s3 ls s3://BUCKET --recursive
6. aws ... s3 cp s3://BUCKET/interesting.db ./loot/
7. Grep loot for passwords, keys, internal URLs

📌 Quick Cheat Sheet

aws configure --profile facts
 
aws --profile facts --endpoint-url=http://facts.htb:54321 s3 ls
aws --profile facts --endpoint-url=http://facts.htb:54321 s3 ls s3://bucket --recursive
aws --profile facts --endpoint-url=http://facts.htb:54321 s3 cp s3://bucket/file.txt ./
aws --profile facts --endpoint-url=http://facts.htb:54321 s3 sync s3://bucket/ ./loot/ --recursive
 
aws sts get-caller-identity --profile facts --endpoint-url=http://facts.htb:54321

Graph View

Backlinks