Spare Key

Difficulty:
Direct link: Spare Key

Objective

Request

Help Goose Barry near the pond identify which identity has been granted excessive Owner permissions at the subscription level, violating the principle of least privilege.

Barry

Solution

Barry asked me to use the Azure CLI to find the admin accidentally uploaded infrastructure config file.

The terminal session introduced the challenge and the Azure CLI environment.

The first task was to list available resource groups using the command:

az group list -o table

The output showed the resource groups available in the subscription.

Task 2 was to list storage accounts in the neighborhood resource group using the command:

az storage account list --resource-group rg-the-neighborhood -o table

The results showed the different storage accounts in the resource group.

Apparently, there is a website in one of the storage accounts.

The next task was to check the blob service properties for each storage account. The first storage account's blob service properties were checked using:

az storage blob service-properties show --account-name neighborhoodhoa --auth-mode login

This revealed that there is a website enabled for the account.

The next task was to list containers in the neighborhoodhoa storage account with the command:

az storage container list --account-name neighborhoodhoa --auth-mode login

The container list showed a $web container.

Task 5 was to list blobs in the $web container using the command:

az storage blob list --account-name neighborhoodhoa --container-name '$web' --output table --auth-mode login

The blob list included iac/terraform.tfvars.

The next task was to download the tfvars file and review its contents with the command:

az storage blob download --account-name neighborhoodhoa --container-name '$web' --name iac/terraform.tfvars --file /dev/stdout --auth-mode login | less

The download of the tfvars file shows that the file contains sensitive information.

The challenge was completed after the finding. I typed finished as required to complete the objective.

The objective was added to the achievements list.

Response

Barry

There it is. A SAS token with read-write-delete permissions, publicly accessible. At least someone around here knows how to do a proper security audit.