TryHackMe — AOC2024: Day 16

Hello and Welcome!

Story Overview:

Wareville faces another cyber incident targeting McSkidy’s Azure Key Vault, a critical piece of its cybersecurity infrastructure. An alert signals unauthorized access, but with audit logs disabled, tracing the attack proves challenging. Exhausted and unable to proceed alone, McSkidy calls for help from Glitch, who dives into the Azure environment to analyze the breach. They uncover a compromised account, wvusr-backupware, linked to suspicious activities and group memberships. By investigating further, they identify the attacker’s path and secure the Azure environment, restoring the Key Vault’s integrity and preventing further breaches.

Learning Objectives:

1. Learn about the structures of Active Directory.
2. Learn about common Active Directory Attacks.
3. Investigate a breach against an Active Directory.

Introduction To Azure Key Vault:

Azure Key Vault is a secure cloud service that helps protect sensitive information such as passwords, API keys, and cryptographic keys. It provides a centralized solution for managing secrets, ensuring they are securely stored and easily accessible to authorized users or applications.

Azure Key Vault is critical for maintaining access control, allowing administrators to set fine-grained permissions to restrict who can view or modify stored secrets. It supports auditing and monitoring, enabling organizations to track access and meet compliance requirements effectively.

The service ensures data security by encrypting secrets both at rest and in transit, preventing unauthorized access even in the event of a breach. For McSkidy, Azure Key Vault plays a vital role in protecting evidence-related data and Wareville’s town secrets, making its security essential to safeguarding the town’s digital infrastructure.

Challenges:

1. What is the password for backupware that was leaked?

• Using Command az ad user listI viewed the users and under username wvusr-backupware the Password was stored under officeLocation since it was different from other users info.
• Answer:R3c0v3r_s3cr3ts!

2.What is the group ID of the Secret Recovery Group?

• Command :az ad grouplist views the list of groups since there is only one group the id is clearly visible .
• Answer:7d96660a-02e1–4112–9515–1762d0cb66b7

3. What is the name of the vault secret? *Commandaz keyvault listgives the name of the vault, note it down and again use the command az keyvault secret show -vault-name warevillesecretswhich shows the answer

• Answer:aoc2024

4. What are the contents of the secret stored in the vault?

• Finally substitute the vault secret in the command az keyvault secret show --vault-name warevillesecrets --name aoc2024the value shows the secred stored in the vault named aoc2024
• Answer:WhereIsMyMind1999

Key Takeaways:

• Explored Microsoft Azure and its Identity Management service Microsoft Entra ID, which controls access to resources based on predefined rules.
• Mastered key Azure CLI commands for enumerating users, groups, and roles within an Azure environment.
• Learned to identify group members and analyze role assignments for effective access control.