{"id":1180,"date":"2026-02-14T23:39:08","date_gmt":"2026-02-14T22:39:08","guid":{"rendered":"https:\/\/babdcatha.net\/?p=1180"},"modified":"2026-03-01T11:52:58","modified_gmt":"2026-03-01T10:52:58","slug":"entragoat-scenario-2","status":"publish","type":"post","link":"https:\/\/babdcatha.net\/index.php\/2026\/02\/14\/entragoat-scenario-2\/","title":{"rendered":"EntraGoat: Scenario 2"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Hello again! This time we&#8217;re going to go through the second scenario of the <a href=\"https:\/\/github.com\/Semperis\/EntraGoat\">EntraGoat<\/a> environment.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This time, we get the account of a lady named Jennifer Clark, and are given a pfx certificate that was apparently leaked through a CI\/CD misconfiguration.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Once again, let&#8217;s start by enumerating the Tenant with the basic account we have access to, using AzureHound.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">.\/azurehound list -u \"jennifer.clark@babdcatha.onmicrosoft.com\" -p 'GoatAccess!123' -t \"babdcatha.onmicrosoft.com\" -o \"scenario2.json\"\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Once imported into BloodHound, we can see this interesting path:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full wp-duotone-unset-1\"><img loading=\"lazy\" decoding=\"async\" width=\"842\" height=\"392\" src=\"https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/BH_path_edited.png\" alt=\"\" class=\"wp-image-1192\" srcset=\"https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/BH_path_edited.png 842w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/BH_path_edited-300x140.png 300w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/BH_path_edited-768x358.png 768w\" sizes=\"auto, (max-width: 842px) 100vw, 842px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">It would indeed be nice if the leaked certificate allowed us to login as the <mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-primary-color\">&#8220;Corporate Finance Analytics&#8221;<\/mark> application. To verify that, we forst need to convert the leaked certificate from a <mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-primary-color\">pfx<\/mark> to a <mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-primary-color\">pem<\/mark> certificate, as only the latter can be used to login with <mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-primary-color\">azcli<\/mark>.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">openssl pkcs12 -in cert.pfx -out cert.pem -nodes<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">We can then check the certificate details to see who it belongs to:<\/p>\n\n\n\n<figure class=\"wp-block-image aligncenter size-large wp-duotone-unset-2\"><img loading=\"lazy\" decoding=\"async\" width=\"647\" height=\"1024\" src=\"https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Openssl_cert_details_edited-647x1024.png\" alt=\"\" class=\"wp-image-1193\" srcset=\"https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Openssl_cert_details_edited-647x1024.png 647w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Openssl_cert_details_edited-190x300.png 190w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Openssl_cert_details_edited-768x1215.png 768w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Openssl_cert_details_edited.png 807w\" sizes=\"auto, (max-width: 647px) 100vw, 647px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The certificate indeed belongs to the Corporate Finance Analytics application. This means that we can use it to authenticate as the application.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large wp-duotone-unset-3\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"205\" src=\"https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/login_as_application_edited-1024x205.png\" alt=\"\" class=\"wp-image-1195\" srcset=\"https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/login_as_application_edited-1024x205.png 1024w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/login_as_application_edited-300x60.png 300w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/login_as_application_edited-768x153.png 768w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/login_as_application_edited-1536x307.png 1536w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/login_as_application_edited.png 1787w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">From the attack path that BloodHound identified, we know that we should be able to do the following:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Add the RoleManagement.ReadWrite.Directory role to the Service Principal we own<\/li>\n\n\n\n<li>Promote it to Global Administrator<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">To do this, we can use the <mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-primary-color\">az ad app permission add<\/mark> subcommand from azcli. But first we need:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The App ID of Microsoft Graph (always <mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-primary-color\">00000003-0000-0000-c000-000000000000<\/mark>)<\/li>\n\n\n\n<li>The App ID of the Service Principal we want to promote<\/li>\n\n\n\n<li>The RoleManagement.ReadWrite.Directory permission ID (which we can find using <a href=\"https:\/\/learn.microsoft.com\/en-us\/graph\/permissions-reference\">Microsoft documentation<\/a>)<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This gives us the final command:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">az ad app permission add --id 638270ce-d630-42ed-9dc9-31b3f5729697 --api 00000003-0000-0000-c000-000000000000 --api-permissions 9e3f62cf-ca93-4989-b6ce-bf83c28f9fe8<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Unfortunately, this appears to be broken. I didn&#8217;t manage to fully find out why, but this might be linked to the depreciation of the V1 Graph API :&#8217;-(<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We can instead use the various Entra powershell modules to do this.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">First, we need to authenticate again, with the pfx certificate this time.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We decode it:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">base64 --decode .\/cert.pfx &gt; cert2.pfx<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">And we create a certificate object that can be used to authenticate<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code lang=\"bash\" class=\"language-bash\">$cert=New-Object System.Security.Cryptography.X509Certificates.X509Certificate2(\"\/home\/kali\/cert2.pfx\", \"GoatAccess!123\")<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">We can then login as the Service Principal:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large wp-duotone-unset-4\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"251\" src=\"https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/MgGraph_login-1024x251.png\" alt=\"\" class=\"wp-image-1196\" srcset=\"https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/MgGraph_login-1024x251.png 1024w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/MgGraph_login-300x74.png 300w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/MgGraph_login-768x188.png 768w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/MgGraph_login.png 1460w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Find The Microsoft Graph ObjectID:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large wp-duotone-unset-5\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"361\" src=\"https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Graph_ObjectID_edited-1024x361.png\" alt=\"\" class=\"wp-image-1197\" srcset=\"https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Graph_ObjectID_edited-1024x361.png 1024w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Graph_ObjectID_edited-300x106.png 300w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Graph_ObjectID_edited-768x271.png 768w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Graph_ObjectID_edited-1536x541.png 1536w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Graph_ObjectID_edited-2048x721.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">And add the role to our Service Principal:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large wp-duotone-unset-6\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"78\" src=\"https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Adding_Role_Entra-1024x78.png\" alt=\"\" class=\"wp-image-1198\" srcset=\"https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Adding_Role_Entra-1024x78.png 1024w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Adding_Role_Entra-300x23.png 300w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Adding_Role_Entra-768x58.png 768w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Adding_Role_Entra-1536x116.png 1536w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Adding_Role_Entra-2048x155.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Once we have this role, we can look for the Global Administrator Role id:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large wp-duotone-unset-7\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"78\" src=\"https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Identifying_globalAdmin-1024x78.png\" alt=\"\" class=\"wp-image-1199\" srcset=\"https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Identifying_globalAdmin-1024x78.png 1024w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Identifying_globalAdmin-300x23.png 300w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Identifying_globalAdmin-768x59.png 768w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Identifying_globalAdmin-1536x117.png 1536w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Identifying_globalAdmin-2048x157.png 2048w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">And give ourselve this role:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large wp-duotone-unset-8\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"98\" src=\"https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Adding_GA-1024x98.png\" alt=\"\" class=\"wp-image-1200\" srcset=\"https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Adding_GA-1024x98.png 1024w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Adding_GA-300x29.png 300w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Adding_GA-768x73.png 768w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Adding_GA-1536x147.png 1536w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Adding_GA.png 1705w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Once we are GA, we can reset the target user&#8217;s credentials:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full wp-duotone-unset-9\"><img loading=\"lazy\" decoding=\"async\" width=\"922\" height=\"428\" src=\"https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/S2_reset_edited.png\" alt=\"\" class=\"wp-image-1201\" srcset=\"https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/S2_reset_edited.png 922w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/S2_reset_edited-300x139.png 300w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/S2_reset_edited-768x357.png 768w\" sizes=\"auto, (max-width: 922px) 100vw, 922px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">And get our flag:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large wp-duotone-unset-10\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"371\" src=\"https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Flag_edited-1024x371.png\" alt=\"\" class=\"wp-image-1202\" srcset=\"https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Flag_edited-1024x371.png 1024w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Flag_edited-300x109.png 300w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Flag_edited-768x278.png 768w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Flag_edited-1536x556.png 1536w, https:\/\/babdcatha.net\/wp-content\/uploads\/2026\/02\/Flag_edited.png 2046w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Hello again! This time we&#8217;re going to go through the second scenario of the EntraGoat environment. This time, we get the account of a lady named Jennifer Clark, and are given a pfx certificate that was apparently leaked through a CI\/CD misconfiguration. Once again, let&#8217;s start by enumerating the Tenant with the basic account we [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[4],"tags":[74,75,73,76],"class_list":["post-1180","post","type-post","status-publish","format-standard","hentry","category-writeups","tag-azurehound","tag-bloodhound","tag-entra","tag-microsoft"],"featured_image_src":null,"author_info":{"display_name":"BabdCatha","author_link":"https:\/\/babdcatha.net\/index.php\/author\/admin4804\/"},"_links":{"self":[{"href":"https:\/\/babdcatha.net\/index.php\/wp-json\/wp\/v2\/posts\/1180","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/babdcatha.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/babdcatha.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/babdcatha.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/babdcatha.net\/index.php\/wp-json\/wp\/v2\/comments?post=1180"}],"version-history":[{"count":12,"href":"https:\/\/babdcatha.net\/index.php\/wp-json\/wp\/v2\/posts\/1180\/revisions"}],"predecessor-version":[{"id":1205,"href":"https:\/\/babdcatha.net\/index.php\/wp-json\/wp\/v2\/posts\/1180\/revisions\/1205"}],"wp:attachment":[{"href":"https:\/\/babdcatha.net\/index.php\/wp-json\/wp\/v2\/media?parent=1180"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/babdcatha.net\/index.php\/wp-json\/wp\/v2\/categories?post=1180"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/babdcatha.net\/index.php\/wp-json\/wp\/v2\/tags?post=1180"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}