Background

NorthLedger Ltd is a mid-sized financial services firm operating a hybrid cloud environment. During pre-engagement OSINT, the assessor performed dark web reconnaissance using a credential monitoring tool. A search against northledger.io returned a hit on a paste site indexed from a dark web marketplace — a leaked .env file traced back to a misconfigured public GitHub repository belonging to a former NorthLedger contractor.

The file contained S3-compatible storage credentials hardcoded into a deployment script:

S3_ENDPOINT=http://<target-ip>:8333
AWS_REGION=us-east-1
AWS_ACCESS_KEY_ID=AKIANL7FSXQM4JYVKPWZ 
AWS_SECRET_ACCESS_KEY=xR3nK8pL2mWvQsYtZu4hJcFdGeNiOoP5BrSvTwCd

Objective

Using the recovered credentials as your initial foothold, assess what access can be obtained against the NorthLedger storage infrastructure. Determine whether the exposed credentials can be leveraged to pivot further into the environment.