Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

EntraGoat Scenario 1: Service Principal Ownership Abuse in Entra ID

semperis.com | blog | #account-takeover | #privilege-escalation | #entra-id | #service-principals | #entragoat | #app-only-auth

Summary

EntraGoat Scenario 1: a compromised low-privileged finance user who owns a privileged enterprise application adds a client secret, pivots into app-only context and takes over the Global Administrator.
Published
Collected

original ↗

Related coverage

blog · semperis.com
EntraGoat Scenario 2: Exploiting App-Only Graph Permissions in Entra ID
EntraGoat Scenario 2: a certificate leaked through CI/CD artifacts leads to app-only Graph permission abuse — self-assigning RoleManagement.ReadWrite.Directory and resetting the Global Admin password.
research · semperis.com
EntraGoat Scenario 6: Exploiting Certificate-Based Authentication to Impersonate Global Admin in Entra ID
EntraGoat Scenario 6: chaining leaked service principal credentials, over-permissive app roles and certificate-based authentication to upload a rogue root CA and impersonate Global Admin.
blog · semperis.com
The Taxonomy of Workload Identities in Entra ID: Service Principals, Enterprise Applications, and Other Forms of Organized Confusion
Chapter two of Semperis' guide unpacks Entra ID workload identities — service principals, applications, managed identities, legacy apps — and introduces the ServiceIdentity principal type for agents.
blog · semperis.com
Getting Started with EntraGoat: Breaking Entra ID the Smart Way
A quick-start guide to EntraGoat: test tenant, Node.js and PowerShell 7 prerequisites, cloning the lab, launching your first challenge, capturing flags and cleaning up afterwards.
blog · semperis.com
What Is EntraGoat? A Deliberately Vulnerable Entra ID Simulation Environment
Introducing EntraGoat: an open-source, deliberately vulnerable Entra ID lab that reproduces real-world misconfigurations in CTF form so identity defenders can safely practice attack paths.
blog · semperis.com
Microsoft Entra Connect Compromise Explained
If attackers seize the Entra Connect server, the ADSync account and PTA agents open a path from on-prem AD to the cloud. The post shows AADInternals-based credential theft and hardening tips.
back