Hacker Holidays Day 9: CryptoCabana

A fake seed phrase backup kiosk, hosted as a static site on Azure Storage. Its own JavaScript leaks a storage SAS token with far broader scope than it needs, which leads to a hidden container, a service principal, and a Key Vault.

Reading the token

app.js had hardcoded storage details:

const STORAGE_ACCOUNT = 'cryptocabanaf5scjagc';
const BACKUP_SAS = '?sv=2022-11-02&ss=b&srt=sco&sp=rl&se=2099-12-31T23:59:59Z&...';

The kiosk only means to write into one container, but the token’s scope tells a different story: srt=sco covers service, container and object level, sp=rl is read plus list, se=2099 never expires. So it can read and list the entire storage account.

Following the chain

Listing the account surfaced a vault container that was never linked anywhere. Inside was backup-service-account.json, a full Azure AD service principal:

{
  "client_id": "dbcf2923-e4eb-4b72-a0a4-688aa1185cf5",
  "client_secret": "REDACTED",
  "key_vault_name": "ccabana-kv-f5scjagc",
  "tenant_id": "8f8c5f8e-42d3-4ceb-97ad-241bbf446d6c"
}

I logged in as it and listed the vault secrets:

az login --service-principal -u <client_id> -p "<secret>" --tenant <tenant_id>
az keyvault secret list --vault-name ccabana-kv-f5scjagc --output table

Three key-shard-* secrets and an expired master-key. The room’s hint was that if a value looks freshly rotated, ask what it looked like five minutes earlier. Checking version history, key-shard-2 had two versions two seconds apart, a rotation. The real value was in the older version:

az keyvault secret show --vault-name ccabana-kv-f5scjagc --name key-shard-2 --version <old-version-id>

The three shards together reconstruct the flag. Redacted here.