> For the complete documentation index, see [llms.txt](https://kabinet.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kabinet.gitbook.io/ctf-writeup/2023/dart-ctf/flag-2.md).

# Flag 2

In the [initiatedart ](https://initiatedart.z13.web.core.windows.net/)endpoint, there is also an URL Pointing to a SAS Token.

<figure><img src="https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2FudjQPdtcuBQA4SoCiBsR%2Fimage.png?alt=media&amp;token=020da291-6a74-4a50-8c25-e2ec77fec68e" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}

```
https://tsarray.blob.core.windows.net/azure-webjobs-secrets/DART.jpg?sv=2021-10-04&ss=b&srt=sco&se=2023-04-14T18%3A19%3A45Z&sp=rl&sig=SL06OYe4kJHHKo3oBD8wrHM8D%2FK6OWU%2FkG1w3wRBpnY%3D
```

{% endcode %}

NETSPI has an amazing [article ](https://www.netspi.com/blog/technical/web-application-penetration-testing/azure-sas-tokens/)on how Azure SAS token work.

{% embed url="<https://www.netspi.com/blog/technical/web-application-penetration-testing/azure-sas-tokens/>" %}

Using [Azure Storage Explorer](https://azure.microsoft.com/en-us/products/storage/storage-explorer), I connect to the storage account using the SAS Token

{% code overflow="wrap" %}

```
https://tsarray.blob.core.windows.net/?sv=2021-10-04&ss=b&srt=sco&se=2023-04-14T18%3A19%3A45Z&sp=rl&sig=SL06OYe4kJHHKo3oBD8wrHM8D%2FK6OWU%2FkG1w3wRBpnY%3D
```

{% endcode %}

In the `tsarray` storage account, there are 3 blob containers. After enumerating for hours, I found the version history for `azure-webjobs-secrets/OSIRIS-REx.txt` which contains the SAS Tokens for the `Logic App` endpoint from the GitHub repository.

<div align="center"><figure><img src="https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2FGyPHEYXX1GwbKzPecatM%2Fimage.png?alt=media&amp;token=9703f257-0a25-4a2b-8f06-6dd4cec8d8d8" alt=""><figcaption></figcaption></figure></div>

In the `tsarray`storage account, there are 3 blob containers. The version history for `azure-webjobs-secrets/OSIRIS-REx.txt`contains the SAS Tokens for the `Logic App` endpoint.

<figure><img src="https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2FXBOj1zG3Zg8vSvQKe5bQ%2Fimage.png?alt=media&amp;token=0325824c-2e22-4eb9-8fc3-3125cd0dca3b" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}

```
api-version=2018-07-01-preview&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=avLLG0xOCALGGT-7zmIJsddcUiL5o2GOijT4mPSA4JY
```

{% endcode %}

There also alot of other useful information within the storage account.

<figure><img src="https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2FBl2W18NpvwCdKfri35E7%2Fimage.png?alt=media&amp;token=53a15d43-d09e-43c6-9081-9596008b1878" alt=""><figcaption></figcaption></figure>

* In the current version of `azure-webjobs-secrets/OSIRIS-REx.txt` in contains a GUID `6de8103e-049a-4f88-9abf-41099a79ca53` which will be useful later.
* In the `azure-webjobs-secrets/rosarray/` it contains a bunch of json file, which contains functions keys and master keys. However, we are unable to use those keys as it is encrypted.

<figure><img src="https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2FFqmlwtZXbzcgeho4j8QC%2Fimage.png?alt=media&amp;token=528221e0-6579-4d3a-bd7d-79f5d5f8e214" alt=""><figcaption></figcaption></figure>

* But we managed to retrieved a function app endpoint [`rosarray.azurewebsites.net`](http://rosarray.azurewebsites.net/)
  * I also identified the function name `blanket`, `canister` and `deployer`

<figure><img src="https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2F66pzhOyjhyLNMsMswHKP%2Fimage.png?alt=media&amp;token=1a8159b9-cf98-4573-8bf4-662077d25154" alt=""><figcaption></figcaption></figure>

Visiting the `logic app` endpoint appended with the SAS Token appended, I am greeted with an error page.

{% code overflow="wrap" %}

```
https://prod-61.eastus.logic.azure.com:443/workflows/250827f3ebc54c368f85643619f38ce3/triggers/manual/paths/invoke/test?api-version=2018-07-01-preview&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=avLLG0xOCALGGT-7zmIJsddcUiL5o2GOijT4mPSA4JY
```

{% endcode %}

<figure><img src="https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2F4MvulGDx9jf4eJ0hE8tD%2Fimage.png?alt=media&amp;token=8d23f4c6-178e-41fe-8d7c-c745791f18d9" alt=""><figcaption></figcaption></figure>

It is because the task `test` that is being requested does not exist. Using `ffuf`, I am able to enumerate the for valid api endpoint.

{% code overflow="wrap" %}

```bash
ffuf -u "https://prod-61.eastus.logic.azure.com/workflows/250827f3ebc54c368f85643619f38ce3/triggers/manual/paths/invoke/FUZZ?api-version=2018-07-01-preview&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=avLLG0xOCALGGT-7zmIJsddcUiL5o2GOijT4mPSA4JY" -w /usr/share/wordlists/seclists/Discovery/Web-Content/api/api-endpoints-res.txt  -fw 162
```

{% endcode %}

<figure><img src="https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2FPLB9LPcaL9QQRXYh1a3r%2Fimage.png?alt=media&amp;token=ad7cd02c-ef0f-42f1-b797-144ec53f5fbd" alt=""><figcaption></figcaption></figure>

I managed to identify 2 valid endpoint, `action` and `debug` and retrieve flag 2 using the `debug` endpoint

{% code overflow="wrap" %}

```
https://prod-61.eastus.logic.azure.com/workflows/250827f3ebc54c368f85643619f38ce3/triggers/manual/paths/invoke/debug?api-version=2018-07-01-preview&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=avLLG0xOCALGGT-7zmIJsddcUiL5o2GOijT4mPSA4JY
```

{% endcode %}

<figure><img src="https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2FHlsySDpFhwvRYdNQrPNw%2Fimage.png?alt=media&amp;token=5056e6e3-af45-4973-8582-8bbc830ee026" alt=""><figcaption></figcaption></figure>

Flag 2: Telemetry check-in confirmed.