I'm not going to be much help. I'm not too sure what you would exploit. Trying to escape the amazon api through some kind of VM escape seems pretty hard and I guess would get you a much bigger bounty from amazon. Maybe use the auth keys to access the accounts? Am I correct in thinking that the box the site is running on is complately different to the one the console is on? Is index.js a clue?

Anyway to more easily see what everyone else is doing run grab_commands() from the browser console.