Challenge

A static site served out of an S3 bucket. The 404 page gives the setup away:

https://s3.us-east-2.amazonaws.com/bucketwars.ctf.csaw.io/404.jpg

It is hosted with the deprecated path-style access, and the bucket name maps cleanly to a host: http://bucketwars.ctf.csaw.io.s3.us-east-2.amazonaws.com/.

Approach

Two things stood out while poking at it. The bucket answered requests without credentials, and the pages carried x-amz-version-id headers, which means object versioning is on. One page (index_v1.html) came back with a null version id, a sign that an earlier object had been overwritten rather than deleted. Old versions of an object stay readable when the bucket is public and listing is allowed.

Solution

List every version of every object straight from the S3 API, no credentials needed:

aws s3api list-object-versions --bucket bucketwars.ctf.csaw.io --no-sign-request

That exposes the prior versions of index_v1.html. Pulling those older copies turns up a password and an image. The image carries the rest, hidden with steghide and unlocked with the recovered password.