University CTF 2023: "You can hack Cloud, I Azure you!" by Panawesome
Source: YouTube · Hack The Box · published Dec 7, 2023 · 22:46
This video demonstrates a practical approach to solving a Microsoft Azure cloud challenge by exploring Azure storage services and exploiting misconfigurations 0:01.
Key Takeaways:
• The presenter scans an Azure challenge environment, identifying open ports including Azurite services which emulate Azure storage locally 1:08.
• Azurite is explained as an open-source emulator for Azure blob, queue, and table storage used for local development and testing 3:00.
• Azure blob storage (binary large objects) is highlighted as a scalable solution for storing unformatted data, commonly used for images, documents, and files 7:22.
• SAS (Shared Access Signature) tokens are used to grant limited access to storage resources without providing full credentials 8:38.
• By exploiting the SAS token and accessing Azure table storage (a NoSQL database), the presenter dumps the user database and finds the flag 14:23.
The video concludes that cloud challenges, even with unfamiliar technologies, can be solved with systematic research and basic security principles 21:34.
Sources:
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cloud Security. Commonly maps to: Security Architecture and Engineering, Communication and Network Security. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
hello everyone this is f aome and this is another Cloud Workshop so the other two Cloud workshops that you can find on our YouTube channel are based on cloud challenges that are built on AWS Services by Amazon the Amazon web services for this one we are going to explore a new territory and this is the Microsoft AO which is the Cloud solution by Microsoft so if you try to look around uh the current most famous web providers the big three of the field is AWS Microsoft azour and the Google D but uh before starting and Diving deep in the theory it's nice I think to try to solve the challenge as is as if it was any other type of challenge like a normal box and see what we can learn so I'm moving away from my notes and uh let's start with the challeng so the first thing that we do quite often is…