Security researcher DMCXBLUE walked through a full attack chain against “Tropicana Bay Hotels”, a fictional hotel chain whose Azure environment he built with his own AzureStrike tool. It starts with unauthenticated tenant and user enumeration plus a password spray, then moves through misconfigured Role-Based Access Control, a readable Key Vault and a service principal with User Administrator rights. A forgotten App Service subdomain with a Jinja template injection hands over managed identity tokens via the instance metadata endpoint, and the Azure SQL database stores user passwords in plaintext. Each step is a small misconfiguration on its own; chained together, they hand over the hotel’s automation and database systems. The recon part is old news: Nestori Syynimaa’s AADInternals post from 2020 shows how an outsider pulls tenant IDs, verified domains and valid usernames from Entra ID without any credentials. MSOLSpray, the spraying tool used here, doubles as a recon tool, because Azure AD’s verbose error codes tell it whether an account exists, is locked or has MFA enabled.
