# svcardproxydevus.starbucks.com Subdomain take over

Dangling DNS record for svcardproxydevus.starbucks.com pointed to a dead Azure Traffic Manager/cloudapp VM, allowing subdomain takeover and internal hash capture.

- Payout: hidden
- Severity: high
- Program: Starbucks
- Found by: txt3rob
- Disclosed: 2018-07-23
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/380158
- Library page: https://bugbountylibrary.com/r/h1%3A380158
- Tags: area:cloud domain:cloud impact:ato impact:internal-access kind:bounty platform:hackerone sev:high tech:azure technique:recon vuln:misconfiguration vuln:subdomain-takeover

**Target:** Azure Traffic Manager endpoint / cloudapp VM via dangling DNS CNAME
**Root cause:** A DNS record for svcardproxydevus.starbucks.com chained to a Traffic Manager profile and an Azure cloudapp VM that no longer existed, leaving the hostname claimable by anyone who re-registers the dead resource.
**Steps:**
1. Enumerate starbucks.com subdomains with `subfinder` and `tko-subs`, or monitor with takeover.cyberint.com.
2. Resolve `svcardproxydevus.starbucks.com` -> `s00307ntmp0svcardproxydev0.trafficmanager.net` -> `s00307dpipsvcardproxy00.eastus.cloudapp.azure.com`.
3. Confirm the final Azure cloudapp VM is dead/unclaimed.
4. Re-register the dangling Azure resource to claim the hostname and serve attacker content.
5. Host a page with an image referencing a UNC path to capture NTLM hashes via Responder.
**How found:** Researcher monitored starbucks.com with takeover.cyberint.com, which flagged two subdomains; then used subfinder and tko-subs to identify which were dead and takeover-able.
**Exploitation:** Attacker claims the dead Azure endpoint, serves content on the trusted Starbucks subdomain, lures support staff to the page, and uses a UNC-path image to force NTLM authentication to a Responder listener, capturing Windows login hashes to crack and pivot via VPN.
**Escalation:** Subdomain takeover -> internal phishing -> NTLM hash capture -> credential cracking -> VPN pivot into corporate network.
**Insight:** Chain-resolve CNAMEs to the final cloud resource (Traffic Manager -> cloudapp) and check whether the terminal resource is still registered; a live-looking intermediate record can mask a dead leaf that is claimable.