Post

Blob Storage Challenge in the Neighborhood

Help the Goose Grace near the pond find which Azure Storage account has been misconfigured to allow public blob access by analyzing the export file.

Posted
By TheDead91
9 min read
Blob Storage Challenge in the Neighborhood

Blob Storage Challenge in the Neighborhood

Difficulty: ❄ ❄ ❄ ❄ ❄
Help the Goose Grace near the pond find which Azure Storage account has been misconfigured to allow public blob access by analyzing the export file.

Hints

Blob Storage Challenge in the Neighborhood

This terminal has built-in hints!

Solution

1
2
3
4
5

🎄 Welcome! 🎄
In a moment, you will be connected to an Azure CLI session in the "neighborhood" tenant.
Your mission: 🔍 Investigate and find WHERE a security vulnerability exists.
Good luck! I'm sure you will do great. Connecting you now...
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

1
2
3
4

You may not know this but the Azure cli help messages are very easy to access. First, try typing:
$ az help | less
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
neighbor@cbbe041f015e:~$ az help | less

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

Next, you've already been configured with credentials. 🔑
  $ az account show | less
  - Pipe the output to | less so you can scroll.
  - Press 'q' to exit less.
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
neighbor@cbbe041f015e:~$ az account show | less
{
  "environmentName": "AzureCloud",
  "id": "2b0942f3-9bca-484b-a508-abdae2db5e64",
  "isDefault": true,
  "name": "theneighborhood-sub",
  "state": "Enabled",
  "tenantId": "90a38eda-4006-4dd5-924c-6ca55cacc14d",
  "user": {
    "name": "theneighborhood@theneighborhood.invalid",
    "type": "user"
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152

Now that you've run a few commands, Let's take a look at some Azure storage accounts.
Try: az storage account list | less
For more information:
https://learn.microsoft.com/en-us/cli/azure/storage/account?view=azure-cli-latest
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
neighbor@cbbe041f015e:~$ az storage account list | less
[
  {
    "id": "/subscriptions/2b0942f3-9bca-484b-a508-abdae2db5e64/resourceGroups/theneighborhood-rg1/providers/Microsoft.Storage/storageAccounts/
neighborhood1",
    "kind": "StorageV2",
    "location": "eastus",
    "name": "neighborhood1",
    "properties": {
      "accessTier": "Hot",
      "allowBlobPublicAccess": false,
      "encryption": {
        "keySource": "Microsoft.Storage",
        "services": {
          "blob": {
            "enabled": true
          }
        }
      },
      "minimumTlsVersion": "TLS1_2"
    },
    "resourceGroup": "theneighborhood-rg1",
    "sku": {
      "name": "Standard_LRS"
    },
    "tags": {
      "env": "dev"
    }
  },
  {
    "id": "/subscriptions/2b0942f3-9bca-484b-a508-abdae2db5e64/resourceGroups/theneighborhood-rg1/providers/Microsoft.Storage/storageAccounts/
neighborhood2",
    "kind": "StorageV2",
    "location": "eastus2",
    "name": "neighborhood2",
    "properties": {
      "accessTier": "Cool",
      "allowBlobPublicAccess": true,
      "encryption": {
        "keySource": "Microsoft.Storage",
        "services": {
          "blob": {
            "enabled": false
          }
        }
      },
      "minimumTlsVersion": "TLS1_0"
    },
    "resourceGroup": "theneighborhood-rg1",
    "sku": {
      "name": "Standard_GRS"
    },
    "tags": {
      "owner": "Admin"
    }
  },
  {
    "id": "/subscriptions/2b0942f3-9bca-484b-a508-abdae2db5e64/resourceGroups/theneighborhood-rg2/providers/Microsoft.Storage/storageAccounts/
neighborhood3",
    "kind": "BlobStorage",
    "location": "westus",
    "name": "neighborhood3",
    "properties": {
      "accessTier": "Hot",
      "allowBlobPublicAccess": false,
      "encryption": {
        "keySource": "Microsoft.Keyvault",
        "services": {
          "blob": {
            "enabled": true
          }
        }
      },
      "minimumTlsVersion": "TLS1_2"
    },
    "resourceGroup": "theneighborhood-rg2",
    "sku": {
      "name": "Standard_RAGRS"
    },
    "tags": {
      "department": "NeighborhoodWatch"
    }
  },
  {
    "id": "/subscriptions/2b0942f3-9bca-484b-a508-abdae2db5e64/resourceGroups/theneighborhood-rg2/providers/Microsoft.Storage/storageAccounts/
neighborhood4",
    "kind": "StorageV2",
    "location": "westus2",
    "name": "neighborhood4",
    "properties": {
      "accessTier": "Hot",
      "allowBlobPublicAccess": false,
      "minimumTlsVersion": "TLS1_2",
      "networkAcls": {
       "bypass": "AzureServices",
        "virtualNetworkRules": []
      }
    },
    "resourceGroup": "theneighborhood-rg2",
    "sku": {
      "name": "Premium_LRS"
    },
    "tags": {
      "critical": "true"
    }
  },
  {
    "id": "/subscriptions/2b0942f3-9bca-484b-a508-abdae2db5e64/resourceGroups/theneighborhood-rg1/providers/Microsoft.Storage/storageAccounts/
neighborhood5",
    "kind": "StorageV2",
    "location": "eastus",
    "name": "neighborhood5",
    "properties": {
      "accessTier": "Cool",
      "allowBlobPublicAccess": false,
      "isHnsEnabled": true,
      "minimumTlsVersion": "TLS1_2"
    },
    "resourceGroup": "theneighborhood-rg1",
    "sku": {
      "name": "Standard_LRS"
    },
    "tags": {
      "project": "Homes"
    }
  },
  {
    "id": "/subscriptions/2b0942f3-9bca-484b-a508-abdae2db5e64/resourceGroups/theneighborhood-rg2/providers/Microsoft.Storage/storageAccounts/
neighborhood6",
    "kind": "StorageV2",
    "location": "centralus",
    "name": "neighborhood6",
    "properties": {
      "accessTier": "Hot",
      "allowBlobPublicAccess": false,
      "minimumTlsVersion": "TLS1_2",
      "tags": {
        "replicate": "true"
      }
    },
    "resourceGroup": "theneighborhood-rg2",
    "sku": {
      "name": "Standard_ZRS"
    },
    "tags": {}
  }
]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

Mmm... one of these looks suspicious 🚨, i think there may be a misconfiguration here somewhere.
Try showing the account that has a common misconfiguration: az storage account show --name xxxxxxxxxx | less
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
neighbor@cbbe041f015e:~$ az storage account show --name neighborhood2 | less
{
  "id": "/subscriptions/2b0942f3-9bca-484b-a508-abdae2db5e64/resourceGroups/theneighborhood-rg1/providers/Microsoft.Storage/storageAccounts/neighborhood2",
  "name": "neighborhood2",
  "location": "eastus2",
  "kind": "StorageV2",
  "sku": {
    "name": "Standard_GRS"
  },
  "properties": {
    "accessTier": "Cool",
    "allowBlobPublicAccess": true,
    "minimumTlsVersion": "TLS1_0",
    "encryption": {
      "services": {
        "blob": {
          "enabled": false
        }
      },
      "keySource": "Microsoft.Storage"
    }
  },
  "resourceGroup": "theneighborhood-rg1",
  "tags": {
    "owner": "Admin"
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

Now we need to list containers in neighborhood2. After running the command what's interesting in the list?
For more information:
https://learn.microsoft.com/en-us/cli/azure/storage/container?view=azure-cli-latest#az-storage-container-list
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
neighbor@cbbe041f015e:~$ key=$(az storage account keys list --account-name neighborhood2 --query "[0].value" -o tsv)
neighbor@cbbe041f015e:~$ az storage container list --account-name neighborhood2 --account-key "$key"
[
  {
    "name": "public",
    "properties": {
      "lastModified": "2024-01-15T09:00:00Z",
      "publicAccess": "Blob"
    }
  },
  {
    "name": "private",
    "properties": {
      "lastModified": "2024-02-05T11:12:00Z",
      "publicAccess": null
    }
  }
]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

Let's take a look at the blob list in the public container for neighborhood2.
For more information:
https://learn.microsoft.com/en-us/cli/azure/storage/blob?view=azure-cli-latest#az-storage-blob-list
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
neighbor@cbbe041f015e:~$ az storage blob list --account-name neighborhood2 --container-name public 
[
  {
    "name": "refrigerator_inventory.pdf",
    "properties": {
      "contentLength": 45678,
      "contentType": "application/pdf",
      "metadata": {
        "created_by": "NeighborhoodWatch",
        "document_type": "inventory",
        "last_updated": "2024-12-15"
      }
    }
  },
  {
    "name": "admin_credentials.txt",
    "properties": {
      "contentLength": 1024,
      "contentType": "text/plain",
      "metadata": {
        "note": "admins only"
      }
    }
  },
  {
    "name": "network_config.json",
    "properties": {
      "contentLength": 2048,
      "contentType": "application/json",
      "metadata": {
        "encrypted": "false",
        "environment": "prod"
      }
    }
  }
]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59

Try downloading and viewing the blob file named admin_credentials.txt from the public container.
💡 hint: --file /dev/stdout should print in the terminal. Dont forget to use | less!
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
neighbor@cbbe041f015e:~$ az storage blob download --account-name neighborhood2 --container-name public --name admin_credentials.txt --file /dev/stdout 
 
# You have discovered an Azure Storage account with "allowBlobPublicAccess": true.
# This misconfiguration allows ANYONE on the internet to view and download files
# from the blob container without authentication.

# Public blob access is highly insecure when sensitive data (like admin credentials)
# is stored in these containers. Always disable public access unless absolutely required.

Azure Portal Credentials
User: azureadmin
Pass: AzUR3!P@ssw0rd#2025

Windows Server Credentials
User: administrator
Pass: W1nD0ws$Srv!@42

SQL Server Credentials
User: sa
Pass: SqL!P@55#2025$

Active Directory Domain Admin
User: corp\administrator
Pass: D0m@in#Adm!n$765

Exchange Admin Credentials
User: exchangeadmin
Pass: Exch@ng3!M@il#432

VMware vSphere Credentials
User: vsphereadmin
Pass: VMW@r3#Clu$ter!99
 
Network Switch Credentials
User: netadmin
Pass: N3t!Sw!tch$C0nfig#

Firewall Admin Credentials
User: fwadmin
Pass: F1r3W@ll#S3cur3!77

Backup Server Credentials
User: backupadmin
Pass: B@ckUp!Srv#2025$

Monitoring System Admin
User: monitoradmin
Pass: M0n!t0r#Sys$P@ss!

SharePoint Admin Credentials
User: spadmin
Pass: Sh@r3P0!nt#Adm!n2025

Git Server Admin
User: gitadmin
Pass: G1t#Srv!Rep0$C0de

1
2
3
4
5
6

🎊 Great, you found the misconfiguration allowing public access to sensitive information!

✅ Challenge Complete! To finish, type: finish
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
neighbor@cbbe041f015e:~$ finish
Completing challenge...

1
2

🎉 Blob Storage Challenge completed! 🎉
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Dissecting the attack

graph TD
    subgraph Recon [1. Cloud Enumeration]
        A["List Storage Accounts
        (az storage account list)"]
        B["Filter Configurations
        (Find allowBlobPublicAccess=true)"]
    end

    subgraph Exploitation [2. Data Exfiltration]
        C["List Containers & Blobs
        (Discover admin-credentials.txt)"]
        D["Download Content
        (Retrieve Cleartext Passwords)"]
    end

    subgraph Impact [3. Impact Analysis]
        E["CWE-312: Credential Exposure
        (Cleartext Admin/SQL/VPN Keys)"]
        F["Full Infrastructure Compromise
        (Valid Credentials for All Systems)"]
    end

    %% Flow Connections
    A -->|Audit Settings| B
    B -->|Identify Target| C
    C -->|Extract Sensitive File| D
    D -->|Read Secrets| E
    E -->|Login to Systems| F

    %% Styling
    style A fill:#7f1d1d,stroke:#ef4444,stroke-width:2px,color:#fff
    style B fill:#9a3412,stroke:#f97316,stroke-width:2px,color:#fff
    style C fill:#7f1d1d,stroke:#ef4444,stroke-width:2px,color:#fff
    style D fill:#7f1d1d,stroke:#ef4444,stroke-width:2px,color:#fff
    style E fill:#7f1d1d,stroke:#ef4444,stroke-width:2px,color:#fff
    style F fill:#9a3412,stroke:#f97316,stroke-width:2px,color:#fff
PhaseVulnerability (CWE)Mitigation
1. Discovery
 CWE-668
Exposure of Resource to Wrong Sphere
(Public Blob Access Enabled)		 Access Control
(Disable Public Access / Private Link)
2. Disclosure
 CWE-312
Cleartext Storage of Sensitive Information
(Credentials in Text File)		 Secret Management
(Azure Key Vault / Managed Identity)

Fixing the Access Control (CWE-668)

Vulnerability: The Azure Storage account was misconfigured with the property "allowBlobPublicAccess": true. This setting allows anyone on the internet to read data in containers configured for public access, without requiring authentication or a SAS token.
Fix: Enforce Deny Public Network Access at the storage account level. This overrides any individual container settings and ensures that data is only accessible via authorized Azure AD identities or private network endpoints.
Vulnerable Configuration (JSON):

1
2
3
4
5

{
  "name": "publicdata",
  "allowBlobPublicAccess": true, // FLAW: Allows anonymous internet access
  "publicNetworkAccess": "Enabled"
}

Secure Configuration (Azure CLI):

1
2
3
4
5

# FIX: Disable public blob access globally for the account
az storage account update \
  --name publicdata \
  --resource-group theneighborhood \
  --allow-blob-public-access false

Impact: Prevents anonymous users from enumerating or downloading blobs, even if a container is accidentally set to “Public”.

Fixing the Credential Storage (CWE-312)

Vulnerability: A file named admin-credentials.txt was stored in the blob container. This file contained cleartext usernames and passwords for critical infrastructure, including Domain Controllers, SQL Servers, and Firewalls.
Fix: Never store credentials in static files (blobs, source code, or config files). Use a dedicated secrets management solution like Azure Key Vault. Applications should retrieve these secrets dynamically at runtime using Managed Identities.
Vulnerable Storage:

  • File: admin-credentials.txt
  • Content: User: azureadmin, Pass: AzUR3!P@ssw0rd#2025

Secure Architecture:

  • Delete the text file.
  • Upload secrets to Key Vault.
  • Grant access only to specific applications via Access Policies or RBAC.

Impact: Even if the storage account is compromised, the attacker finds no usable credentials, only encrypted blobs or data references that require further authentication to decrypt.

SANS Holiday Hack Challenge 2025, SANS Holiday Hack Challenge 2025 - Act I
SANS Holiday Hack Challenge 2025 Holiday Hack Challenge Holiday Hack Challenge 2025 Blob Storage Challenge in the Neighborhood
This post is licensed under CC BY 4.0 by the author.