MENU
SIMULATION
You've discovered that the compromised user holds directory-level privileges. Enumerate how this role can be abused to compromise another user in the directory. What is the Job Title attribute of the compromised target user?
Flag{92c8bfe4a73f48a6bd94e62fca2179dd}
Detailed Solution:
As the second compromised user, enumerate directory users:
az ad user list --output table
Use a cleaner query to show names, UPNs, and job titles:
az ad user list
--query '[].{DisplayName:displayName,UPN:userPrincipalName,JobTitle:jobTitle}'
--output table
You should identify a target user whose profile contains a flag in the jobTitle attribute.
The important target is:
lila.nguyen@azuresecops.onmicrosoft.com
Her jobTitle field contains:
Flag{92c8bfe4a73f48a6bd94e62fca2179dd}
Because the compromised user has User Administrator, you can reset this target user's password and later authenticate as her.
Final Answer:
Flag{92c8bfe4a73f48a6bd94e62fca2179dd}
================