competition-cloud-metadata-path

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Chinese

Use this skill only as a downstream specialization after

$ctf-sandbox-orchestrator

is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to

$ctf-sandbox-orchestrator

first.

Use this skill when the decisive edge is not just reaching metadata, but proving how metadata-derived identity becomes accepted privilege.

Reply in Simplified Chinese unless the user explicitly requests English.

本技能仅可在

$ctf-sandbox-orchestrator

已处于激活状态，且已经完成沙箱假设建立、节点所有权确认和证据优先级划分后，作为下游专属技能使用。如果还未完成上述步骤，请先返回

$ctf-sandbox-orchestrator

流程。

当核心突破点不止是访问到元数据，而是需要证明从元数据获取的身份如何转换为可被认可的权限时，请使用本技能。

除非用户明确要求英文回复，否则请使用简体中文回复。

Identify which metadata surface is active: instance metadata, workload identity, node identity, task role, or platform-specific token endpoint.
Record the exact reachability path: local process, pod, container, proxy, SSRF surface, or host route.
Separate metadata reachability from credential issuance and from downstream privilege acceptance.
Keep token format, role identity, scope, and accepting API in compact evidence blocks.
Reproduce the smallest metadata-to-accepted-privilege path that proves the challenge edge.

Record the metadata endpoint, required headers, hop limits, session tokens, workload selectors, or path prefixes.
Note whether access comes from direct local calls, pod networking, SSRF, sidecar, or host-level routing.
Keep the reaching surface and the metadata endpoint in one chain.

Show how the metadata response becomes a token, temporary credential, signed identity doc, or platform-specific workload identity.
Record expiration, role name, subject, audience, issuer, or cloud account mapping that matters downstream.
Distinguish raw metadata from usable credential material.

Compress the result to the smallest sequence: reaching surface -> metadata call -> credential issued -> accepted cloud or cluster action.
State clearly whether the weakness lives in reachability, metadata config, role trust, downstream policy, or workload binding.
If the challenge narrows to RBAC or cluster mutation after credential issuance, switch back to the tighter control-plane skill.

Load
```
references/cloud-metadata-path.md
```
for the reachability checklist, token checklist, and evidence packaging.
If the hard part is first proving a server-side fetch primitive, SSRF reachability, or internal endpoint traversal before metadata itself, prefer
```
$competition-ssrf-metadata-pivot
```
.

加载
```
references/cloud-metadata-path.md
```
获取可达性检查清单、令牌检查清单和证据打包规范。
如果难点在于在访问元数据之前，首先要证明服务端获取原语、SSRF可达性或内部端点遍历能力，请优先使用
```
$competition-ssrf-metadata-pivot
```
。

Metadata endpoints, required headers, reachability path, issued tokens or creds, and accepted APIs
Role names, audiences, issuers, account bindings, and privilege-bearing actions
The smallest replayable metadata-to-privilege chain