~/challenges $ cat weekly/10_open_bucket_at_europort_gates.md
Cloud Security / Misconfiguration Easy–Medium
Live · Week 10
CHALLENGE #10 · Released 16 June 2026

Open Bucket at EuroPort Gates

REWARD +250 pts

Briefing

intel://sss/briefing_10.txt

INTELEuroPort Container Terminal 4, 14:05 local. Driverless straddle carriers, automated stacking cranes, OCR cameras at the gates — thousands of containers a day, all moved by a cloud-synchronised telemetry queue.

Our external attack surface monitoring lit up on a routine perimeter sweep. A third-party logistics vendor — the one running the OCR cameras at the automated entry gates — left an S3-compatible object storage bucket world-readable. Anyone with the URL can walk the directory like it’s a shared drive.

Most of what’s in there is exactly what it claims to be: log files, camera captures, telemetry exports. One file isn’t. Somebody dropped a legacy backup archive into a root subfolder — the kind of thing an engineer uploads in a hurry and forgets about.

Operator, find the bucket. Parse the listing. Lift the archive. Pull the credential before anyone else does.

Objective

Locate the legacy archive in backup.zip and submit the credential hidden inside as the flag.

Evidence

.html
bucket_listing.html
html · S3 bucket directory listing
↓ Download
.zip
backup.zip
zip · legacy backup archive
↓ Download

Capture the Flag

Submit your solution · +250 pts on success
Format: GRID-2026-XXXX
One submission per solve. Points post to the leaderboard on verify.