> For the complete documentation index, see [llms.txt](https://kabinet.gitbook.io/ctf-writeup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kabinet.gitbook.io/ctf-writeup/2025/thuderdome/crossing-the-great-divide.md). # Crossing the great divide ## Solve Within the same zip file, theres a initial-config.sql file. The file contains another set of credentials which we can add into our loot

From our prior enumeration, we know that the Virtual Machine has an system assigned management identity. Lets try and dump that.

With the identity endpoint and token, we are able curl to get the management api. {% code overflow="wrap" %} ```bash curl "http://127.0.0.1:41041/msi/token/?resource=https://management.azure.com/&api-version=2017-09-01" -H "Secret: 41F02D3D5B464799867FCD3897A16785" ``` {% endcode %}

With the access token, lets connect and enumerate Az Resources.

From the Get-AzResource output, we can see that theres a virtual machine running. Lets enumerate it more next.

Next, lets get the public IP address of the virtual machine and attempt to authenticate to it.

Get-AzPublicIpAddress -ResourceGroupName SQLANALYSIS02_GROUP

From the nmap output, we can see port 1433 is open, with ms-sql running on it. Lets attempt to use impacket to authenticate with the credentials we have.

Enumerating the sql server, I noticed that there is trusted link.

Referring the [payloadallthethings](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/MSSQL%20Injection.md#mssql-trusted-links), letst try and attempt to exploit the trusted link.

attempting to select the version on the server on 34.74.254.28

Now that we established that we managed to access the sql server via the trusted link. Lets enumerate it again. {% code overflow="wrap" %} ```sql SELECT * FROM OPENQUERY("34.74.254.28", 'SELECT table_name FROM bulkimport.INFORMATION_SCHEMA.TABLES WHERE table_type = ''BASE TABLE'''); ``` {% endcode %}

{% code overflow="wrap" %} ```sql SELECT COLUMN_NAME FROM OPENQUERY([34.74.254.28], 'SELECT COLUMN_NAME FROM bulkimport.INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME = ''myqueries'''); ``` {% endcode %}

{% code overflow="wrap" %} ```sql SELECT * FROM OPENQUERY([34.74.254.28], 'SELECT queries FROM [bulkimport].[dbo].[myqueries]'); ``` {% endcode %}

From the output, we can see a reference to Google Cloud Storage. GCS has interoperability with Amazon S3. So lets use s3cmd to dump the files within the GCS. First, we configure .s3cfg file with the following data.

We are able to then use s3cmd to interact with GCS as if its a normal S3 bucket.

From manual enumeration, only mp-bulk-insert and the gcf-v2-sources-454107766132-us-central1 bucket contains file. Lets download and inspect the data.

Looking at the bulkinsert.bcp and bulkinsert.fmt, it contains the format for the data to be inserted, as well as some PII data.

Next, looking at the zip file, upon unziping they both give the same file.

Looking at the source code, it is probably Google Cloud Function application, which contains hard coded Service account credentials.

Lets copy out the service account json, save it as analysis.json and authenticate with it.

I will be using the tool [Bruteforce-GCP-Permissions](https://github.com/carlospolop/Bruteforce-GCP-Permissions) to enumerate our permission.

From the output, it seems like analysis has alot of permissions over artifact registry. Artifact registry is basically a container registry similar to Docker Hub, but hosted on GCP. Listing the repositories

Listing the images in the repositories mp-default

gcloud artifacts docker images list us-east1-docker.pkg.dev/mp-proj-1-413623/mp-default

Configuring docker to refer to the Artifact Registries.

gcloud auth configure-docker us-east1-docker.pkg.dev

Pulling the docker images

docker pull us-east1-docker.pkg.dev/mp-proj-1-413623/mp-default/mp-seave@sha256:fc131d02bd19913bd3cbafc7c5d66c27af674ed99ea5a6c1522cca25075c417e

Next, we will run the docker container to enumerate the filesystems. {% code overflow="wrap" %} ```bash docker run -it us-east1-docker.pkg.dev/mp-proj-1-413623/mp-default/mp-seave@sha256:fc131d02bd19913bd3cbafc7c5d66c27af674ed99ea5a6c1522cca25075c417e /bin/bash ``` {% endcode %} Looking at the /app directory there is another service account json for the service account automation.

Looking at the /root directory, we are able to retrieve the flag.

## TLDR * Retrieve a db password from init-config.sql * Get Access Token for managed identity * Enumerate azure resources * Identify that there is a virtual machine running and retrieve the public IP Address * Perform nmap to identify open port and services * Utilize impacket mssqlclient to authenticate with the credentials from init-config.sql * Abuse trusted link to access another database on 34.74.254.28 * Retrieve the GCS credentials from the database on 34.74.254.28 * Authenticate to GCS and dump the files using s3cmd * Authenticate to gcloud with the `analysis`service account json * Bruteforce for permissions using Bruteforce-GCP-Permissions * Identify that `analysis`has access to gcloud artifact registries * Enumerate and pull docker images from artifact registries * Retrieve `automation`service account json from /app directory * Get the flag from the /root directory ## Reference * * * * * [https://cloud.google.com/artifact-registry/docs](https://cloud.google.com/artifact-registry/docshttps://cloud.google.com/sdk/gcloud/reference/artifacts/docker) *