Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

EntraGoat Scenario 3: Exploiting Group Ownership in Entra ID

semperis.com | research | #privilege-escalation | #entra-id | #attack-paths | #semperis | #entragoat | #group-ownership

Summary

EntraGoat Scenario 3: how group ownership, role-assignable groups and service principal management chain from a low-privileged user to Global Administrator — plus detection and defense guidance.
Published
Collected

original ↗

Related coverage

research · semperis.com
EntraGoat Scenario 6: Exploiting Certificate-Based Authentication to Impersonate Global Admin in Entra ID
EntraGoat Scenario 6: chaining leaked service principal credentials, over-permissive app roles and certificate-based authentication to upload a rogue root CA and impersonate Global Admin.
blog · semperis.com
EntraGoat Scenario 2: Exploiting App-Only Graph Permissions in Entra ID
EntraGoat Scenario 2: a certificate leaked through CI/CD artifacts leads to app-only Graph permission abuse — self-assigning RoleManagement.ReadWrite.Directory and resetting the Global Admin password.
blog · semperis.com
Getting Started with EntraGoat: Breaking Entra ID the Smart Way
A quick-start guide to EntraGoat: test tenant, Node.js and PowerShell 7 prerequisites, cloning the lab, launching your first challenge, capturing flags and cleaning up afterwards.
research · semperis.com
UnOAuthorized: Privilege Elevation Through Microsoft Applications
Semperis found Microsoft app permissions in Entra ID could act beyond intended authorization—even adding users to Global Administrator. Fixed via MSRC; covers detecting prior abuse and hardening.
research · starlabs.sg
[CVE-2025-39964] How I Found a $113,337 AF_ALG Linux Local Privilege Escalation Before Copy Fail
A retrospective on CVE-2025-39964, an AF_ALG race condition causing out-of-bounds scatterlist access in the Linux kernel. Exploitation yields root and a Docker container escape.
research · starlabs.sg
Old Wine in a New Bottle: A Decade-Old lxd-Group Root, Re-Armed
Ubuntu Server silently puts the first user in the lxd group, root-equivalent by design. The seeded lxd-installer socket lets lxd users install LXD password-free and reach host root; vendor won't fix.
back