You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/pentesting-cloud/azure-security/README.md
+25-20Lines changed: 25 additions & 20 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,6 +4,8 @@
4
4
5
5
## Basic Information
6
6
7
+
Learn the basics of Azure and Entra ID in the following page:
8
+
7
9
{{#ref}}
8
10
az-basic-information/
9
11
{{#endref}}
@@ -12,11 +14,16 @@ az-basic-information/
12
14
13
15
In order to audit an AZURE environment it's very important to know: which **services are being used**, what is **being exposed**, who has **access** to what, and how are internal Azure services and **external services** connected.
14
16
15
-
From a Red Team point of view, the **first step to compromise an Azure environment** is to manage to obtain some **credentials** for Azure AD. Here you have some ideas on how to do that:
17
+
From a Red Team point of view, the **first step to compromise an Azure environment** is to manage to obtain some **foothold**.
18
+
19
+
### Initial Access
20
+
21
+
Here you can find the most common ways to get initial access to an Azure/Entra ID environment:
16
22
17
-
-**Leaks** in github (or similar) - OSINT
23
+
-**OSINT**: Check for **leaks** in Github or any other open source platform that could contain **credentials** or interesting information.
24
+
-
18
25
-**Social** Engineering
19
-
-**Password** reuse (password leaks)
26
+
-**Password** reuse, leaks or [password spraying](az-unauthenticated-enum-and-initial-entry/az-password-spraying.md)
20
27
- Vulnerabilities in Azure-Hosted Applications
21
28
-[**Server Side Request Forgery**](https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html) with access to metadata endpoint
22
29
-**Local File Read**
@@ -31,7 +38,6 @@ From a Red Team point of view, the **first step to compromise an Azure environme
31
38
-**Internal** Employee
32
39
-[**Common Phishing**](https://book.hacktricks.wiki/en/generic-methodologies-and-resources/phishing-methodology/index.html) (credentials or Oauth App)
The following tools will be super useful to enumerate both Entra ID tenants and Azure environments slowly (to avoid detection) or automatically (to save time):
@@ -132,7 +147,7 @@ Get-AzRoleAssignment -SignInName [email protected] # For current user
132
147
133
148
### Entra ID Enumeration
134
149
135
-
By default, any user should have **enough permissions to enumerate** things such us, users, groups, roles, service principals... (check [default AzureAD permissions](az-basic-information/index.html#default-user-permissions)).\
150
+
By default, any user should have **enough permissions to enumerate** things such as users, groups, roles, service principals... (check [default AzureAD permissions](az-basic-information/index.html#default-user-permissions)).\
136
151
You can find here a guide:
137
152
138
153
{{#ref}}
@@ -143,17 +158,7 @@ az-services/az-azuread.md
143
158
> Now that you **have some information about your credentials** (and if you are a red team hopefully you **haven't been detected**). It's time to figure out which services are being used in the environment.\
144
159
> In the following section you can check some ways to **enumerate some common services.**
145
160
146
-
## App Service SCM
147
-
148
-
Kudu console to log in to the App Service 'container'.
149
-
150
-
## Webshell
151
-
152
-
Use portal.azure.com and select the shell, or use shell.azure.com, for a bash or powershell. The 'disk' of this shell are stored as an image file in a storage-account.
153
-
154
-
## Azure DevOps
155
-
156
-
Azure DevOps is separate from Azure. It has repositories, pipelines (yaml or release), boards, wiki, and more. Variable Groups are used to store variable values and secrets.
Copy file name to clipboardExpand all lines: src/pentesting-cloud/azure-security/az-basic-information/README.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -32,7 +32,7 @@
32
32
33
33
All the **resources** must be **inside a resource group** and can belong only to a group and if a resource group is deleted, all the resources inside it are also deleted.
Copy file name to clipboardExpand all lines: src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/README.md
+71-59Lines changed: 71 additions & 59 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,24 +7,23 @@
7
7
### Tenant Enumeration
8
8
9
9
There are some **public Azure APIs** that just knowing the **domain of the tenant** an attacker could query to gather more info about it.\
10
-
You can query directly the API or use the PowerShell library [**AADInternals**](https://github.com/Gerenios/AADInternals)**:**
10
+
You can query directly the API or use the PowerShell library [**AADInternals**](https://github.com/Gerenios/AADInternals) (`Install-Module AADInternals`):
| login.microsoftonline.com/\<domain>/.well-known/openid-configuration |**Login information**, including tenant ID |`Get-AADIntTenantID -Domain <domain>`|
15
-
| autodiscover-s.outlook.com/autodiscover/autodiscover.svc |**All domains** of the tenant |`Get-AADIntTenantDomains -Domain <domain>`|
16
-
| login.microsoftonline.com/GetUserRealm.srf?login=\<UserName> | <p><strong>Login information</strong> of the tenant, including tenant Name and domain <strong>authentication type.</strong><br>If <code>NameSpaceType</code> is <strong><code>Managed</code></strong>, it means <strong>AzureAD</strong> is used.</p> |`Get-AADIntLoginInformation -UserName <UserName>`|
-`Get-AADIntTenantID -Domain <domain>` (main API `login.microsoftonline.com/<domain>/.well-known/openid-configuration`)
14
+
-**All valid doimains in the tenant**
15
+
-`Get-AADIntTenantDomains -Domain <domain>`(main API `autodiscover-s.outlook.com/autodiscover/autodiscover.svc`)
16
+
-**Login information of the user**. If `NameSpaceType` is `Managed`, it means EntraID is used
17
+
-`Get-AADIntLoginInformation -UserName <UserName>`(main API `login.microsoftonline.com/GetUserRealm.srf?login=<UserName>`)
18
18
19
-
You can query all the information of an Azure tenant with **just one command of the**[**AADInternals**](https://github.com/Gerenios/AADInternals)**library**:
19
+
You can query all the information of an Azure tenant with **just one command from**[**AADInternals**](https://github.com/Gerenios/AADInternals):
20
20
21
21
```bash
22
+
# Doesn't work in macos because 'Resolve-DnsName' doesn't exist
@@ -44,6 +43,9 @@ Moreover, the output presents the names of all verified domains associated with
44
43
45
44
### User Enumeration
46
45
46
+
> [!TIP]
47
+
> Note that even if a tenant is using several emails for the same user, the **username is unique**. This means that it'll noly work with the domain the user has associated and not with the other domains.
48
+
47
49
It's possible to **check if a username exists** inside a tenant. This includes also **guest users**, whose username is in the format:
Get-Content .\users.txt | Invoke-AADIntUserEnumerationAsOutsider -Method Normal
84
86
```
85
87
86
-
There are **three different enumeration methods** to choose from:
88
+
Currenlty there are **4 different enumeration methods** to choose from. You can find information in `Get-Help Invoke-AADIntUserEnumerationAsOutsider`:
89
+
90
+
It supports following enumeration methods: Normal, Login, Autologon, and RST2.
91
+
92
+
- The **Normal** method seems currently work with all tenants. Previously it required Desktop SSO (aka Seamless SSO) to be enabled for at least one domain.
93
+
94
+
- The **Login** method works with any tenant, but enumeration queries will be logged to Azure AD sign-in log as failed login events!
95
+
96
+
- The **Autologon** method doesn't seem to work with all tenants anymore. Probably requires that DesktopSSO or directory sync is enabled.
| Normal | This refers to the GetCredentialType API mentioned above. The default method. |
91
-
| Login | <p>This method tries to log in as the user.<br><strong>Note:</strong> queries will be logged to sign-ins log.</p> |
92
-
| Autologon | <p>This method tries to log in as the user via autologon endpoint.<br><strong>Queries are not logged</strong> to sign-ins log! As such, works well also for password spray and brute-force attacks.</p> |
93
98
94
99
After discovering the valid usernames you can get **info about a user** with:
@@ -113,10 +123,16 @@ The API of Microsoft Teams allows to search for users. In particular the "user s
113
123
114
124
Depending on the API response it is possible to distinguish between non-existing users and existing users that have a valid Teams subscription.
115
125
116
-
The script [**TeamsEnum**](https://github.com/sse-secure-systems/TeamsEnum) could be used to validate a given set of usernames against the Teams API.
126
+
The script [**TeamsEnum**](https://github.com/sse-secure-systems/TeamsEnum) could be used to validate a given set of usernames against the Teams API but you need access to a user with Teams access to use it.
117
127
118
128
```bash
119
-
python3 TeamsEnum.py -a password -u <username> -f inputlist.txt -o teamsenum-output.json
python3 ./TeamsEnum.py -a password -u <username> -f inputlist.txt -o teamsenum-output.json
120
136
```
121
137
122
138
Output:
@@ -192,58 +208,54 @@ Output:
192
208
}
193
209
```
194
210
195
-
##Azure Services
211
+
### Password Spraying / Brute-Force
196
212
197
-
Know that we know the **domains the Azure tenant** is using is time to try to find **Azure services exposed**.
213
+
{{#ref}}
214
+
az-password-spraying.md
215
+
{{#endref}}
198
216
199
-
You can use a method from [**MicroBust**](https://github.com/NetSPI/MicroBurst) for such goal. This function will search the base domain name (and a few permutations) in several **azure service domains:**
217
+
## Azure Services using domains
218
+
219
+
It's also possible to try to find **Azure services exposed** in common azure subdomains like the ones documented in this [post:
You can use a method from [**MicroBust**](https://github.com/NetSPI/MicroBurst) for such goal. This function will search the base domain name (and a few permutations) in several **azure domains:**
You could discover open storage with a tool such as [**InvokeEnumerateAzureBlobs.ps1**](https://github.com/NetSPI/MicroBurst/blob/master/Misc/Invoke-EnumerateAzureBlobs.ps1) which will use the file **`Microburst/Misc/permitations.txt`** to generate permutations (very simple) to try to **find open storage accounts**.
# Access then https://corpcommon.blob.core.windows.net/secrets/ssh_info.json
220
-
```
221
-
222
-
### SAS URLs
223
-
224
-
A _**shared access signature**_ (SAS) URL is an URL that **provides access** to certain part of a Storage account (could be a full container, a file...) with some specific permissions (read, write...) over the resources. If you find one leaked you could be able to access sensitive information, they look like this (this is to access a container, if it was just granting access to a file the path of the URL will also contain that file):
Use [**Storage Explorer**](https://azure.microsoft.com/en-us/features/storage-explorer/) to access the data
229
-
230
-
## Compromise Credentials
231
248
232
-
###Phishing
249
+
## Phishing
233
250
234
-
-[**Common Phishing**](https://book.hacktricks.wiki/en/generic-methodologies-and-resources/phishing-methodology/index.html)(credentials or OAuth App -[Illicit Consent Grant Attack](az-oauth-apps-phishing.md)-)
251
+
-[**Common Phishing**](https://book.hacktricks.wiki/en/generic-methodologies-and-resources/phishing-methodology/index.html)for credentials or via [OAuth Apps](az-oauth-apps-phishing.md)
0 commit comments