Lab Walkthrough: How RCE on EC2 Can Expose AWS IAM Credentials via IMDSv2

A cybersecurity training lab by Cybr Academy demonstrates how an unsanitized command injection flaw in a web application can be exploited to achieve Remote Code Execution on an AWS EC2 instance. The vulnerable endpoint accepted user-supplied shell commands without validation, allowing an attacker to run arbitrary code as root. Using the RCE foothold, the attacker queried the Instance Metadata Service v2 (IMDSv2) by first obtaining a session token, then extracting temporary IAM credentials tied to an attached role. Those stolen credentials were used locally to authenticate against AWS and discover an accessible S3 bucket. The lab concludes with the attacker successfully retrieving a sensitive file from S3, illustrating the real-world risk of chaining web vulnerabilities with cloud metadata abuse.