EntraGoat Scenario 3 – Group MemberShipwreck: Sailed into Admin Waters

Objective

Gain access to the target administrative account and retrieve the flag stored in the extensionAttribute1 attribute.

Initial Access

User:

michael.chen@neho7890gmail.onmicrosoft.com

Password:

GoatAccess!123

Target User:

EntraGoat-admin-s3@neho7890gmail.onmicrosoft.com

Hint:

Owning a group isn't harmless, right?

---

Enumeration

After authenticating as Michael Chen, I performed enumeration using RoadRecon.

Reviewing Michael’s owned objects revealed ownership of several Azure AD groups:

• Marketing Team
• Finance Department
• AI Development Team
• IT Application Managers
• Network Operations Team
• Security Testing Team

Several of these groups were configured as Role Assignable Groups.

Interesting Finding

The group:

IT Application Managers

was assigned the Azure AD role:

Application Administrator

Michael was configured as the Owner of the group but was not initially a member.

This created a privilege escalation opportunity.

---

Privilege Escalation – Group Ownership Abuse

As the owner of the role-assignable group, I added Michael as a member.

After refreshing the session, Michael inherited the:

Application Administrator

role.

This provided the ability to manage Enterprise Applications and Service Principals within the tenant.

---

Enterprise Application Enumeration

Using the newly obtained privileges, I enumerated service principals.

A custom enterprise application was identified:

Identity Management Portal

Application Details:

Display Name: Identity Management Portal
AppId: 7be6e23b-f0b5-44e1-98ad-5ad9bfd8f2af

Further inspection revealed that the application was associated with the group:

Identity Security Team

The Identity Security Team held the following Azure AD role:

Privileged Authentication Administrator

---

Service Principal Takeover

As Application Administrator, I added myself as an owner of the Identity Management Portal service principal.

New-MgServicePrincipalOwnerByRef `
-ServicePrincipalId $sp.Id `
-BodyParameter @{
    "@odata.id" = "<https://graph.microsoft.com/v1.0/directoryObjects/$($user.Id)>"
}

Graph accepted the owner add, so I now controlled the service principal.

---

Secret Injection

With ownership of the service principal established, I generated a new client secret.

$secret = Add-MgServicePrincipalPassword -ServicePrincipalId $sp.Id

That secret let me authenticate as the application directly, dropping me into its privilege context instead of Michael’s.

---

Application Authentication

I authenticated directly as the compromised application.

Connect-MgGraph `
-TenantId $tenantId `
-ClientSecretCredential $cred

Verification:

AuthType: AppOnly
AppName: Identity Management Portal

At this point I was operating with the permissions granted to the application.

---

Abuse of Privileged Authentication Administrator

Because the Identity Management Portal was a member of the Identity Security Team, and that group held the:

Privileged Authentication Administrator

role, the application inherited the ability to manage authentication methods.

I generated a Temporary Access Pass (TAP) for the target administrator account.

New-MgUserAuthenticationTemporaryAccessPassMethod `
-UserId $target.Id `
-BodyParameter @{
    isUsableOnce = $true
    lifetimeInMinutes = 60
}

The TAP came back valid — a usable credential for the target admin account.

---

Flag Retrieval

Using the obtained privileges, I queried the target user’s extension attributes.

Get-MgUser `
-UserId "EntraGoat-admin-s3@neho7890gmail.onmicrosoft.com" `
-Property "onPremisesExtensionAttributes"

The flag was stored in:

extensionAttribute1

Flag:

EntraGoat{Gr0up_Ch@1n_Pr1v_Esc@l@t10n!}

---

Attack Path Summary

Michael Chen
    ↓
Owner of IT Application Managers
    ↓
Add Self as Group Member
    ↓
Application Administrator
    ↓
Take Over Identity Management Portal
    ↓
Add Service Principal Secret
    ↓
Authenticate as Application
    ↓
Identity Security Team Membership
    ↓
Privileged Authentication Administrator
    ↓
Create Temporary Access Pass
    ↓
Access EntraGoat-admin-s3
    ↓
Read extensionAttribute1

Key Takeaway

This scenario demonstrates how ownership of a Role Assignable Group can lead to full tenant privilege escalation when combined with:

• Group membership abuse
• Azure AD role inheritance
• Service Principal takeover
• Application authentication
• Privileged Authentication Administrator permissions

The chain highlights the security impact of misconfigured group ownership and privileged application relationships inside Microsoft Entra ID.