GPEN Azure Apps and Attacks — 10 Questions

Question 1

An attacker has compromised an Azure AD application with the 'User.Read.All' delegated permission. They seek to elevate privileges by abusing the 'onBehalfOf' flow. What is the primary requirement for this attack to succeed?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The initial token must contain a valid 'oid' claim and have sufficient scopes for the downstream request.. The on-behalf-of flow allows a middle-tier application to exchange a user's token for a new token to access downstream services. Attackers exploit this by tricking a user into authenticating to a malicious app, which then uses the captured token to impersonate the user against sensitive APIs. Understanding this flow is critical for assessing how delegated permissions can be escalated beyond the initial scope intended by the service principal.

Answer

The application must be configured with a client secret that matches the user's password.

Answer

The resource application must explicitly trust the client application's Application ID.

Answer

The target API must be configured to use Managed Identities instead of Service Principals.

Question 2

Which TWO of the following actions are necessary for an attacker to perform a 'Consent Phishing' attack against an Azure AD tenant?

Accepted Answer

Registering a multi-tenant Azure AD application.. Consent phishing involves tricking users into granting malicious applications permissions to their data. The attacker must register an application in an Azure tenant and then convince users to authorize it. This bypasses conditional access policies if the attacker uses an app that users are permitted to consent to, making it a highly effective technique for persistent access in cloud environments without requiring administrative credentials.

Answer

Gaining Global Administrator privileges on the target tenant.

Answer

Modifying the tenant's Conditional Access policies to allow guest users.

Answer

Disabling Multi-Factor Authentication for the target users.

Question 3

Refer to the exhibit. Which security implication does this application configuration have regarding access control?

Accepted Answer

It enforces that users must have an explicit assignment to use the application.. The setting 'AppRoleAssignmentRequired' set to true forces the application to verify that a user has been explicitly assigned to the application via an AppRoleAssignment. This is a critical security control that prevents any user in the tenant from accessing the application by default, mitigating unauthorized access even if the application is multi-tenant and the user is authenticated.

Answer

It allows any user in the tenant to access the application without explicit assignment.

Answer

It automatically grants the User.Read scope to all users in the tenant.

Answer

It disables the need for OAuth2 consent for all users.

Question 4

An attacker finds an Azure Function with an improperly secured HTTP trigger. They want to enumerate the environment variables of the function. Which path is the most likely target for this enumeration?

Accepted Answer

/proc/self/environ. Azure Functions store configuration as environment variables, which are accessible to the process running the code. In vulnerable implementations where the function exposes sensitive data or allows for arbitrary code execution, an attacker can use the Kudu API or local environment inspection to read these variables, often uncovering database connection strings, API keys, or Managed Identity tokens that facilitate further lateral movement.

Answer

/admin/environment

Answer

/etc/azure/config

Answer

/api/config/secrets

Question 5

A developer has assigned a User-Assigned Managed Identity to an Azure App Service. The attacker successfully gains local file access to the App Service instance. How can they obtain an OAuth token for the Azure Resource Manager (ARM) API?

Accepted Answer

By invoking the Identity endpoint at 169.254.169.254/metadata/identity/oauth2/token.. Managed Identities provide an IMDS (Instance Metadata Service) endpoint at 169.254.169.254. By making a crafted request to this endpoint with the correct identity headers, an attacker can retrieve a valid OAuth access token for any resource, including ARM. This is a common post-exploitation technique where the attacker pivots from the App Service identity to perform management actions against the broader Azure subscription.

Answer

By querying the Kudu API with the App Service's 'WEBSITE_AUTH_TOKEN'.

Answer

By decrypting the 'appsettings.json' file in the root directory.

Answer

By brute-forcing the application's client secret from the environment variables.

Question 6

Which THREE of the following are common misconfigurations in Azure AD application registrations that lead to potential privilege escalation?

Accepted Answer

Granting 'Directory.ReadWrite.All' delegated permissions.. Microsoft Entra ID apps are frequent targets for attackers. Over-privileged scopes, unnecessary multi-tenancy, and exposed client secrets are the most common vectors. Attackers look for these misconfigurations to move from low-privileged application contexts to high-privileged directory roles or to gain unauthorized access to sensitive user data, bypassing standard tenant security controls.

Answer

Hardcoding the Application ID in the source code.

Answer

Using a self-signed certificate for the application's manifest.

Question 7

Refer to the exhibit. An Azure storage account has this policy applied to its blob container. What is the most significant security impact of this configuration?

Accepted Answer

It allows any identity assigned this policy to perform any operation on the storage account.. The policy grants full administrative 'Allow' access to all actions on all resources, which is essentially a 'super-user' wildcard permission. This effectively bypasses the Principle of Least Privilege and allows anyone with the identity associated with this policy to perform any destructive action, including deleting containers or modifying access control lists, leading to a total compromise of the data storage layer.

Answer

It enables anonymous read access to all blob data.

Answer

It forces the use of HTTPS for all incoming connections.

Answer

It restricts access to a specific VNet range.

Question 8

An attacker has compromised an Azure AD user account with MFA enabled. What is the most likely technique they will use to maintain access without constantly triggering MFA?

Accepted Answer

Generating a new OAuth refresh token to extend the session.. Attackers focus on stealing session cookies or using OAuth refresh tokens to bypass MFA. Once a session is established and the MFA challenge is completed, the resulting session token or refresh token can be used to authenticate the user session without re-prompting, effectively allowing the attacker to persist without needing further MFA interaction.

Answer

Disabling the user's MFA settings in the Azure Portal.

Answer

Registering a new MFA device on the user's account.

Answer

Injecting a malicious password hash into the directory.

Question 9

Which TWO of the following are valid methods to identify Azure AD applications that have excessive permissions in a production environment?

Accepted Answer

Reviewing the 'OAuth2Permissions' and 'AppRoles' in the application manifest.. Auditing application permissions is crucial for security. Using the Microsoft Graph API to programmatically review permissions or running Microsoft Entra ID identity protection reports helps identify over-privileged service principals. These methods allow security teams to proactively reduce the blast radius of a potential application compromise by revoking unused or overly broad delegated and application permissions.

Answer

Scanning the 'AppService' source code for hardcoded passwords.

Answer

Analyzing the Azure Activity Logs for login events.

Answer

Checking the storage account's access keys for the application.

Question 10

An attacker has gained access to an Azure VM with a System-Assigned Managed Identity. They find the IMDS endpoint is accessible. What prevents them from simply requesting a token for the Microsoft Graph API?

Accepted Answer

The Managed Identity lacks the necessary permissions assigned in the target API.. While the IMDS endpoint is accessible, the Managed Identity must still be granted specific RBAC or API permissions within the target resource (like Microsoft Graph). If the administrator has not granted the identity 'User.Read' or other Graph permissions, the token exchange will be successful, but the resulting token will be denied by the Graph API for any actual operations, effectively neutralizing the attack.

Answer

The IMDS endpoint requires a client secret to validate the request.

Answer

The IMDS endpoint is only reachable from within a VNet.

Answer

The Azure AD tenant disables Managed Identity by default.