You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/pentesting-cloud/azure-security/README.md
+95-62Lines changed: 95 additions & 62 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,53 +16,47 @@ In order to audit an AZURE environment it's very important to know: which **serv
16
16
17
17
From a Red Team point of view, the **first step to compromise an Azure environment** is to manage to obtain some **foothold**.
18
18
19
-
### Initial Access
19
+
### External enum & Initial Access
20
20
21
-
Here you can find the most common ways to get initial access to an Azure/Entra ID environment:
21
+
The first step is of course to enumerate information about the tenant you are attacking and try to get a foothold.
22
22
23
-
-**OSINT**: Check for **leaks** in Github or any other open source platform that could contain **credentials** or interesting information.
24
-
-
25
-
-**Social** Engineering
26
-
-**Password** reuse, leaks or [password spraying](az-unauthenticated-enum-and-initial-entry/az-password-spraying.md)
27
-
- Vulnerabilities in Azure-Hosted Applications
28
-
-[**Server Side Request Forgery**](https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html) with access to metadata endpoint
29
-
-**Local File Read**
30
-
-`/home/USERNAME/.azure`
31
-
-`C:\Users\USERNAME\.azure`
32
-
- The file **`accessTokens.json`** in `az cli` before 2.30 - Jan2022 - stored **access tokens in clear text**
33
-
- The file **`azureProfile.json`** contains **info** about logged user.
34
-
-**`az logout`** removes the token.
35
-
- Older versions of **`Az PowerShell`** stored **access tokens** in **clear** text in **`TokenCache.dat`**. It also stores **ServicePrincipalSecret** in **clear**-text in **`AzureRmContext.json`**. The cmdlet **`Save-AzContext`** can be used to **store****tokens**.\
36
-
Use `Disconnect-AzAccount` to remove them.
37
-
- 3rd parties **breached**
38
-
-**Internal** Employee
39
-
-[**Common Phishing**](https://book.hacktricks.wiki/en/generic-methodologies-and-resources/phishing-methodology/index.html) (credentials or Oauth App)
Based on the domain name it's possible to know **if the company if using Azure**, get the **tenant ID**, get other **valid domains** in the same tenant (if more) and get **relevant information** like if SSO is enabled, mail configurations, valid user emails...
41
24
42
-
Even if you **haven't compromised any user** inside the Azure tenant you are attacking, you can **gather some information** from it:
25
+
Check the folloeing page to learn how to perform the **external enumeration**:
43
26
44
27
{{#ref}}
45
28
az-unauthenticated-enum-and-initial-entry/
46
29
{{#endref}}
47
30
48
-
> [!NOTE]
49
-
> After you have managed to obtain credentials, you need to know **to who do those creds belong**, and **what they have access to**, so you need to perform some basic enumeration:
31
+
With this information the most common ways to try to get a foothold are:
32
+
-**OSINT**: Check for **leaks** in Github or any other open source platform that could contain **credentials** or interesting information.
33
+
-**Password** reuse, leaks or [password spraying](az-unauthenticated-enum-and-initial-entry/az-password-spraying.md)
34
+
- Buy credentials to an employee
35
+
-[**Common Phishing**](https://book.hacktricks.wiki/en/generic-methodologies-and-resources/phishing-methodology/index.html) (credentials or Oauth App)
-[**Server Side Request Forgery**](https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html) with access to metadata endpoint
40
+
-**Subdomain takeovers** like in [https://godiego.co/posts/STO-Azure/](https://godiego.co/posts/STO-Azure/)
41
+
- If some developer laptop is compromised ([WinPEAS and LinPEAS](https://github.com/peass-ng/PEASS-ng) can find this info):
42
+
- Inside **`<HOME>/.Azure`**
43
+
-**`azureProfile.json`** contains info about logged in users from the past
44
+
-**`clouds.config contains`** info about subscriptions
45
+
-**`service_principal_entries.json`** contains applications credentials (tenant id, clients and secret). Only in Linux & macOS
46
+
-**`msal_token_cache.json`** contains contains access tokens and refresh tokens. Only in Linux & macOS
47
+
-**`service_principal_entries.bin`** and msal_token_cache.bin are used in Windows and are encrypted with DPAPI
48
+
-**`msal_http_cache.bin`** is a cache of HTTP request
49
+
- Load it: `with open("msal_http_cache.bin", 'rb') as f: pickle.load(f)`
50
+
-**`AzureRmContext.json`** contains information about previous logins using Az PowerShell (but no credentials)
51
+
- Inside **`C:\Users\<username>\AppData\Local\Microsoft\IdentityCache\*`** are several `.bin` files with **access tokens**, ID tokens and account information encrypted with the users DPAPI.
52
+
- It’s possible to find more **access tokens** in the `.tbres` files inside **`C:\Users\<username>\AppData\Local\Microsoft\TokenBroken\Cache\`** which contain a base64 encrypted with DPAPI with access tokens.
53
+
- In Linux and macOS you can get **access tokens, refresh tokens and id tokens** from Az PowerShell (if used) running `pwsh -Command "Save-AzContext -Path /tmp/az-context.json"`
54
+
- In Windows this just generates id tokens.
55
+
- Possible to see if Az PowerShell was used in Linux and macSO checking is `$HOME/.local/share/.IdentityService/` exists (although the contained files are empty and useless)
50
56
51
-
## Basic Enumeration
52
57
53
58
> [!NOTE]
54
-
> Remember that the **noisiest** part of the enumeration is the **login**, not the enumeration itself.
55
-
56
-
### SSRF
57
-
58
-
If you found a SSRF in a server inside Azure check this page for tricks:
# Enumerate all resources visible to the current user
134
-
Get-AzResource
135
-
# Enumerate all Azure RBAC role assignments
136
-
Get-AzRoleAssignment # For all users
137
-
Get-AzRoleAssignment -SignInName [email protected]# For current user
116
+
```
117
+
118
+
{{#endtab }}
119
+
120
+
{{#tab name="Mg" }}
121
+
122
+
```bash
123
+
#Get the current session
124
+
Get-MgContext
125
+
```
126
+
127
+
{{#endtab }}
128
+
129
+
{{#tab name="AzureAD" }}
130
+
131
+
```bash
132
+
#Get the current session state
133
+
Get-AzureADCurrentSessionInfo
134
+
#Get details of the current tenant
135
+
Get-AzureADTenantDetail
138
136
```
139
137
140
138
{{#endtab }}
141
139
{{#endtabs }}
142
140
143
-
> [!CAUTION]
144
-
> Oone of the most important commands to enumerate Azure is **`Get-AzResource`** from Az PowerShell as it lets you **know the resources your current user has visibility over**.
145
-
>
146
-
> You can get the same info in the **web console** going to [https://portal.azure.com/#view/HubsExtension/BrowseAll](https://portal.azure.com/#view/HubsExtension/BrowseAll) or searching for "All resources"
147
141
148
-
### Entra ID Enumeration
142
+
### Entra ID Enumeration & Privilege Escalation
149
143
150
144
By default, any user should have **enough permissions to enumerate** things such as users, groups, roles, service principals... (check [default AzureAD permissions](az-basic-information/index.html#default-user-permissions)).\
151
145
You can find here a guide:
@@ -154,11 +148,50 @@ You can find here a guide:
154
148
az-services/az-azuread.md
155
149
{{#endref}}
156
150
157
-
> [!NOTE]
158
-
> Now that you **have some information about your credentials** (and if you are a red team hopefully you **haven't been detected**). It's time to figure out which services are being used in the environment.\
159
-
> In the following section you can check some ways to **enumerate some common services.**
151
+
Check the **Post-Exploitation tools** to find tools to escalate privileges in Entra ID like **AzureHound:**
Once you know who you are, you can start enumerating the **Azure services you have access to**.
161
+
162
+
The Az PoswerShell command **`Get-AzResource`** lets you **know the resources your current user has visibility over**.
160
163
161
-
###
164
+
Moreover, you can get the same info in the **web console** going to [https://portal.azure.com/#view/HubsExtension/BrowseAll](https://portal.azure.com/#view/HubsExtension/BrowseAll) or searching for "All resources" or executing: `az rest --method GET --url "https://management.azure.com/subscriptions/<subscription-id>/resources?api-version=2021-04-01"`
165
+
166
+
Furthermore, with enough permissions, the role **`Get-AzRoleAssignment`** can be used to **enumerate all the roles** in the subscription or the permission over a specific resource indicatig it like in: **`Get-AzRoleAssignment -Scope /subscriptions/9291ff6e-6afb-430e-82a4-6f04b2d05c7f/resourceGroups/Resource_Group_1/providers/Microsoft.RecoveryServices/vaults/vault-m3ww8ut4`**
167
+
168
+
In the following section you can find information about the most common Azure services and how to enumerate them:
169
+
170
+
{{#ref}}
171
+
az-services/
172
+
{{#endref}}
173
+
174
+
### Privilege Escalation, Post-Exploitation & Persistence in Azure Services
175
+
176
+
Once you know how is the Azure environment structured and what services are being used, you can start looking for ways to **escalate privileges, move laterally, perform other post-exploitation attacks and maintain persistence**.
177
+
178
+
In the following section you can find information about how to escalate privileges in the most common Azure services:
179
+
180
+
{{#ref}}
181
+
az-privilege-escalation/
182
+
{{#endref}}
183
+
184
+
In the following one you can find information about how to perform post-exploitation attacks in the most common Azure services:
185
+
186
+
{{#ref}}
187
+
az-post-exploitation/
188
+
{{#endref}}
189
+
190
+
In the following one you can find information about how to maintain persistence in the most common Azure services:
-**appid**: Application ID used to generate the token
152
+
-**appidacr**: The Application Authentication Context Class Reference indicates how the client was authenticated, for a public client the value is 0, and if a client secret is used the value is 1
153
+
-**acr**: The Authentication Context Class Reference claim is "0" when the end-user authentication did not meet the requirements of ISO/IEC 29115.
154
+
-**amr**: The Authentication method indicates how the token was authenticated. A value of “pwd” indicates that a password was used.
155
+
-**groups**: Indicates the groups where the principal is a member.
156
+
-**iss**: The issues identifies the security token service (STS) that generated the token. e.g. https://sts.windows.net/fdd066e1-ee37-49bc-b08f-d0e152119b04/ (the uuid is the tenant ID)
157
+
-**oid**: The object ID of the principal
158
+
-**tid**: Tenant ID
159
+
-**iat, nbf, exp**: Issued at (when it was issued), Not before (cannot be used before this time, usually same value as iat), Expiration time.
160
+
161
+
149
162
## FOCI Tokens Privilege Escalation
150
163
151
164
Previously it was mentioned that refresh tokens should be tied to the **scopes** it was generated with, to the **application** and **tenant** it was generated to. If any of these boundaries is broken, it's possible to escalate privileges as it will be possible to generate access tokens to other resources and tenants the user has access to and with more scopes than it was originally intended.
0 commit comments