Hacker Holidays – Day 9 – CryptoCabana Walkthrough

Bybwright

Room: TryHackMe – CryptoCabana
Category: Cloud Security / Azure
Difficulty: Medium

Overview

CryptoCabana is an Azure-focused challenge that demonstrates how several seemingly minor cloud misconfigurations can be chained together into a complete compromise. The room begins with nothing more than a simple web application, but careful inspection reveals enough information to enumerate Azure Storage, discover additional resources, authenticate as a service principal, and explore Azure Key Vault.

This walkthrough documents the process used to complete the room while intentionally omitting the final flag.

Initial Recon

The first step was simply exploring the web application and inspecting its source.

Using the browser’s View Source and Developer Tools, I discovered JavaScript containing configuration values that should never have been exposed to the client.

const STORAGE_ACCOUNT = "...";
const BACKUPS_CONTAINER = "...";
const BACKUP_SAS = "...";

The most important discovery was a Shared Access Signature (SAS) token embedded directly in the JavaScript.

This immediately suggested the application was interacting directly with Azure Storage from the browser rather than through a secure backend.

Enumerating Azure Storage

After configuring the Azure CLI with the exposed SAS token, I enumerated the storage account.

az storage container list \
  --account-name <storage-account> \
  --sas-token "$BACKUP_SAS" \
  -o table

Several containers were present, including one that was never referenced anywhere within the website.

That hidden container became the next target.

Investigating the Hidden Container

Listing the blobs inside the hidden container revealed two interesting files.

az storage blob list \
  --account-name <storage-account> \
  --container-name <container> \
  --sas-token "$BACKUP_SAS" \
  -o table

One of those files contained configuration information for an Azure automation account.

Rather than hardcoded user credentials, the application exposed the credentials for an Azure Service Principal, allowing authenticated access to additional Azure resources.

Authenticating to Azure

Using the recovered Service Principal credentials, I authenticated with the Azure CLI.

az login --service-principal \
  --username <client-id> \
  --password "<client-secret>" \
  --tenant <tenant-id>

Once authenticated, I could interact with resources that were previously inaccessible.

Exploring Azure Key Vault

The next step was enumerating the Azure Key Vault.

az keyvault secret list \
  --vault-name <vault-name> \
  -o table

Several secrets were available.

Attempting to read one particular secret resulted in an authorization error, indicating that Azure RBAC protections were functioning correctly for that specific object.

Rather than forcing access, the challenge encouraged investigating the remaining secrets more carefully.

Following the Rotation Clue

One of the room’s hints referenced a value that had been “freshly rotated.”

That clue pointed toward Azure Key Vault’s version history.

Listing previous versions of the relevant secret revealed multiple revisions.

az keyvault secret list-versions \
  --vault-name <vault-name> \
  --name "<secret-name>" \
  -o table

Retrieving an older version of the secret provided the missing piece needed to continue solving the challenge.

This is an excellent reminder that rotating credentials alone is not sufficient if previous versions remain accessible.

Completing the Challenge

After gathering each required secret fragment, the final value could be reconstructed.

The actual flag has been intentionally omitted from this walkthrough.

Security Lessons Learned

This room highlights several common cloud security mistakes:

  • Never expose SAS tokens in client-side JavaScript.
  • Keep SAS tokens short-lived and tightly scoped.
  • Follow the Principle of Least Privilege.
  • Store automation credentials securely.
  • Audit Azure Storage containers regularly.
  • Review Azure Key Vault secret version history after rotations.
  • Remember that rotating secrets without removing older accessible versions can still leave sensitive information exposed.

Commands Used

# Enumerate storage containers
az storage container list

# List blobs
az storage blob list

# Download blob
az storage blob download

# Authenticate with a Service Principal
az login --service-principal

# List Key Vault secrets
az keyvault secret list

# View secret versions
az keyvault secret list-versions

# Read a specific secret
az keyvault secret show

Final Thoughts

CryptoCabana is an excellent Azure-focused room that demonstrates how cloud misconfigurations often cascade into one another. What begins as an exposed client-side configuration ultimately leads through storage enumeration, identity abuse, Key Vault exploration, and secret version analysis.

Rather than relying on exploitation, the room rewards careful observation, cloud enumeration skills, and an understanding of how Azure services interact. It serves as a great introduction to cloud security concepts that defenders and penetration testers alike should understand.

hhttps://tryhackme.com/room/hh-cryptocabana-f81cac95

Similar Posts