Continuing on with the enumeration of the key vault, there are few other secrets within it.
0704d1bc-950f-42c8-b0cd-c0569d111da1
Ascension
Flag8
Flag9
Attempting to list Flag9 will show a forbidden error.
I decided to use MicroBurst Get-AzPasswords as I didnt want to manually list the remaining secrets. I refer to this NETSPI blog on how to utilize the Get-AzPasswords
git clone https://github.com/NetSPI/MicroBurstipmo .\MicroBurst.psm1Get-AzPasswords-Keys Y
Luckily I used the Get-AzPasswords as I wasn’t aware that the user has the ability to retrieve the key vault keys LICIACube.
In the 0704d1bc-950f-42c8-b0cd-c0569d111da1 secret, it shows an encrypted text. After some googling, I found this article that shows how to decrypt using the key vault key.
