Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

EntraGoat Scenario 2: Exploiting App-Only Graph Permissions in Entra ID

semperis.com | blog | #privilege-escalation | #entra-id | #semperis | #microsoft-graph | #entragoat | #app-only-auth

Summary

EntraGoat Scenario 2: a certificate leaked through CI/CD artifacts leads to app-only Graph permission abuse — self-assigning RoleManagement.ReadWrite.Directory and resetting the Global Admin password.
Published
Collected

original ↗

Related coverage

blog · semperis.com
EntraGoat Scenario 1: Service Principal Ownership Abuse in Entra ID
EntraGoat Scenario 1: a compromised low-privileged finance user who owns a privileged enterprise application adds a client secret, pivots into app-only context and takes over the Global Administrator.
blog · semperis.com
Getting Started with EntraGoat: Breaking Entra ID the Smart Way
A quick-start guide to EntraGoat: test tenant, Node.js and PowerShell 7 prerequisites, cloning the lab, launching your first challenge, capturing flags and cleaning up afterwards.
blog · semperis.com
Power up Entra ID Security Assessments
Semperis offers a PowerShell script that automates Entra ID app registration for free Purple Knight assessments, requiring Microsoft.Graph.Applications, Az.Accounts, and Global Admin rights.
research · semperis.com
EntraGoat Scenario 3: Exploiting Group Ownership in Entra ID
EntraGoat Scenario 3: how group ownership, role-assignable groups and service principal management chain from a low-privileged user to Global Administrator — plus detection and defense guidance.
research · semperis.com
EntraGoat Scenario 6: Exploiting Certificate-Based Authentication to Impersonate Global Admin in Entra ID
EntraGoat Scenario 6: chaining leaked service principal credentials, over-permissive app roles and certificate-based authentication to upload a rogue root CA and impersonate Global Admin.
blog · semperis.com
Introducing Migrator 2.0: Move Active Directory with Confidence
Semperis introduces Migrator for Active Directory 2.0, an update aimed at helping organizations move Active Directory environments with confidence and greater operational control.
back