Azure

Basic Info

**Tools** 
https://github.com/dirkjanm/ROADtools
https://github.com/dafthack/PowerMeta
https://github.com/NetSPI/MicroBurst
https://github.com/nccgroup/ScoutSuite
https://github.com/hausec/PowerZure
https://github.com/fox-it/adconnectdump
https://github.com/FSecureLABS/Azurite
https://github.com/mburrough/pentestingazureapps
https://github.com/Azure/Stormspotter
https://github.com/nccgroup/azucar
https://github.com/dafthack/MSOLSpray
https://github.com/BloodHoundAD/BloodHound
https://github.com/nccgroup/Carnivore
https://github.com/CrowdStrike/CRT
https://github.com/Kyuu-Ji/Awesome-Azure-Pentest
https://github.com/cyberark/blobhunter

- Check if company is using Azure AD:
https://login.microsoftonline.com/getuserrealm.srf?login=username@COMPANY.onmicrosoft.com&xml=1
- If NameSpaceType is "Managed", the company uses Azure AD
- Enumerate Azure AD emails
https://github.com/LMGsec/o365creeper

Auth methods:
• Password Hash Synchronization
   ◇ Azure AD Connect
   ◇ On-prem service synchronizes hashed user credentials to Azure
   ◇ User can authenticate directly to Azure services like O365 with their internal domain credential
• Pass Through Authentication
   ◇  Credentials stored only on-prem
   ◇ On-prem agent validates authentication requests to Azure AD
   ◇ Allows SSO to other Azure apps without creds stored in cloud
• Active Directory Federation Services (ADFS)
   ◇ Credentials stored only on-prem
   ◇ Federated trust is setup between Azure and on-prem AD to validate auth requests to the cloud
   ◇ For password attacks you would have to auth to the on-prem ADFS portal instead of Azure endpoints
• Certificate-based auth
   ◇ Client certs for authentication to API
   ◇ Certificate management in legacy Azure Service Management (ASM) makes it impossible to know who created a cert (persistence potential)
   ◇ Service Principals can be setup with certs to auth
• Conditional access policies
• Long-term access tokens
   ◇ Authentication to Azure with oAuth tokens
   ◇ Desktop CLI tools that can be used to auth store access tokens on disk
   ◇ These tokens can be reused on other MS endpoints
   ◇ We have a lab on this later!
• Legacy authentication portals

Recon:
• O365 Usage
   ◇ https://login.microsoftonline.com/getuserrealm.srf?login=username@acmecomputercompany.com&xml=1
   ◇ https://outlook.office365.com/autodiscover/autodiscover.json/v1.0/test@targetdomain.com?Protocol=Autodiscoverv1
• User enumeration on Azure can be performed at
    https://login.Microsoft.com/common/oauth2/token
      ▪ This endpoint tells you if a user exists or not
   ◇ Detect invalid users while password spraying with:
      ▪ https://github.com/dafthack/MSOLSpray
   ◇ For on-prem OWA/EWS you can enumerate users with timing attacks (MailSniper)
• Auth 365 Recon:
(https://github.com/nyxgeek/o365recon

Microsoft Azure Storage:
• Microsoft Azure Storage is like Amazon S3
• Blob storage is for unstructured data
• Containers and blobs can be publicly accessible via access policies
• Predictable URL’s at core.windows.net
   ◇ storage-account-name.blob.core.windows.net
   ◇ storage-account-name.file.core.windows.net
   ◇ storage-account-name.table.core.windows.net
   ◇ storage-account-name.queue.core.windows.net
• The “Blob” access policy means anyone can anonymously read blobs, but can’t list the blobs in the container
• The “Container” access policy allows for listing containers and blobs
• Microburst https://github.com/NetSPI/MicroBurst
   ◇ Invoke-EnumerateAzureBlobs
   ◇ Brute forces storage account names, containers, and files
   ◇ Uses permutations to discover storage accounts
        PS > Invoke-EnumerateAzureBlobs –Base 

Password Attacks
• Password Spraying Microsoft Online (Azure/O365)
• Can spray https://login.microsoftonline.com
--
POST /common/oauth2/token HTTP/1.1
Accept: application/json
Content-Type: application/x-www-form-urlencoded
Host: login.microsoftonline.com
Content-Length: 195
Expect: 100-continue
Connection: close

resource=https%3A%2F%2Fgraph.windows.net&client_id=1b730954-1685-4b74-9bfd-
dac224a7b894&client_info=1&grant_type=password&username=user%40targetdomain.com&passwor
d=Winter2020&scope=openid
--
• MSOLSpray https://github.com/dafthack/MSOLSpray
   ◇ The script logs:
      ▪ If a user cred is valid
      ▪ If MFA is enabled on the account
      ▪ If a tenant doesn't exist
      ▪ If a user doesn't exist
      ▪ If the account is locked
      ▪ If the account is disabled
      ▪ If the password is expired
   ◇ https://docs.microsoft.com/en-us/azure/active-directory/develop/reference-aadsts-error-codes

Password protections & Smart Lockout
• Azure Password Protection – Prevents users from picking passwords with certain words like seasons, company name, etc.
• Azure Smart Lockout – Locks out auth attempts whenever brute force or spray attempts are detected.
   ◇ Can be bypassed with FireProx + MSOLSpray
   ◇ https://github.com/ustayready/fireprox

Phising session hijack
• Evilginx2 and Modlishka
   ◇ MitM frameworks for harvesting creds/sessions
   ◇ Can also evade 2FA by riding user sessions
• With a hijacked session we need to move fast
• Session timeouts can limit access
• Persistence is necessary

Steal Access Tokens
• Azure config files:
   web.config
   app.config
   .cspkg
   .publishsettings
• Azure Cloud Service Packages (.cspkg)
• Deployment files created by Visual Studio
• Possible other Azure service integration (SQL, Storage, etc.)
• Look through cspkg zip files for creds/certs
• Search Visual Studio Publish directory
    \bin\debug\publish
• Azure Publish Settings files (.publishsettings)
   ◇ Designed to make it easier for developers to push code to Azure
   ◇ Can contain a Base64 encoded Management Certificate
   ◇ Sometimes cleartext credentials
   ◇ Open publishsettings file in text editor
   ◇ Save “ManagementCertificate” section into a new .pfx file
   ◇ There is no password for the pfx
   ◇ Search the user’s Downloads directory and VS projects
• Check %USERPROFILE&\.azure\ for auth tokens
• During an authenticated session with the Az PowerShell module a TokenCache.dat file gets generated in the %USERPROFILE%\.azure\ folder.
• Also search disk for other saved context files (.json)
• Multiple tokens can exist in the same context file

Post-Compromise
• What can we learn with a basic user?
• Subscription Info
• User Info
• Resource Groups
• Scavenging Runbooks for Creds
• Standard users can access Azure domain information and isn’t usually locked down
• Authenticated users can go to portal.azure.com and click Azure Active Directory
• O365 Global Address List has this info as well
• Even if portal is locked down PowerShell cmdlets will still likely work
• There is a company-wide setting that locks down the entire org from viewing Azure info via cmd line: Set-MsolCompanySettings – UsersPermissionToReadOtherUsersEnabled $false

Azure: CLI Access
• Azure Service Management (ASM or Azure “Classic”)
   ◇ Legacy and recommended to not use
• Azure Resource Manager (ARM)
   ◇ Added service principals, resource groups, and more
   ◇ Management Certs not supported
• PowerShell Modules
   ◇ Az, AzureAD & MSOnline
• Azure Cross-platform CLI Tools
   ◇ Linux and Windows client

Azure: Subscriptions
• Organizations can have multiple subscriptions
• A good first step is to determine what subscription you are in
• The subscription name is usually informative
• It might have “Prod”, or “Dev” in the title
• Multiple subscriptions can be under the same Azure AD directory (tenant)
• Each subscription can have multiple resource groups

Azure User Information
• Built-In Azure Subscription Roles
   ◇ Owner (full control over resource)
   ◇ Contributor (All rights except the ability to change permissions)
   ◇ Reader (can only read attributes)
   ◇ User Access Administrator (manage user access to Azure resources)
• Get the current user’s role assignement
    PS> Get-AzRoleAssignment
• If the Azure portal is locked down it is still possible to access Azure AD user information via MSOnline cmdlets
• The below examples enumerate users and groups
    PS> Import-Module MSOnline
    PS> Connect-MsolService
Or
    PS> $credential = Get-Credential
    PS> Connect-MsolService -Credential $credential

    PS> Get-MSolUser -All
    PS> Get-MSolGroup –All
    PS> Get-MSolGroupMember –GroupObjectId 
    PS> Get-MSolCompanyInformation
• Pipe Get-MSolUser –All to format list to get all user attributes
    PS> Get-MSolUser –All | fl

Azure Resource Groups
• Resource Groups collect various services for easier management
• Recon can help identify the relationships between services such as WebApps and SQL
    PS> Get-AzResource
    PS> Get-AzResourceGroup
    PS> Get-AzStorageAccount
Azure: Runbooks
• Azure Runbooks automate various tasks in Azure
• Require an Automation Account and can contain sensitive information like passwords
    PS> Get-AzAutomationAccount
    PS> Get-AzAutomationRunbook -AutomationAccountName  -ResourceGroupName 
• Export a runbook with:
    PS> Export-AzAutomationRunbook -AutomationAccountName  -ResourceGroupName  -Name  -OutputFolder .\Desktop\

Azure VMs:
   PS> Get-AzVM
   PS> $vm = Get-AzVM -Name "VM Name"
   PS> $vm.OSProfile
   PS> Invoke-AzVMRunCommand -ResourceGroupName $ResourceGroupName -VMName $VMName -CommandId RunPowerShellScript -ScriptPath ./powershell-script.ps1

Azure Virtual Networks:
   PS> Get-AzVirtualNetwork
   PS> Get-AzPublicIpAddress
   PS> Get-AzExpressRouteCircuit
   PS> Get-AzVpnConnection

# Quick 1-liner to search all Azure AD user attributes for passwords after auth'ing with Connect-MsolService:  
$x=Get-MsolUser;foreach($u in $x){$p = @();$u|gm|%{$p+=$_.Name};ForEach($s in $p){if($u.$s -like "*password*"){Write("[*]"+$u.UserPrincipalName+"["+$s+"]"+" : "+$u.$s)}}}

# https://www.synacktiv.com/posts/pentest/azure-ad-introduction-for-red-teamers.html

# Removing Azure services
- Under Azure Portal -> Resource Groups

# Interesting metadata instance urls:
http://169.254.169.254/metadata/v1/maintenance
http://169.254.169.254/metadata/instance?api-version=2017-04-02
http://169.254.169.254/metadata/instance/network/interface/0/ipv4/ipAddress/0/publicIpAddress?api-version=2017-04-02&format=text

Traditional AD - Azure AD comparision

Basic Azure AD concepts and tips

Azure attacks examples

Azure Block Blobs (S3 equivalent) attacks

Azure subdomain takeovers

Other Azure Services

Create Azure service principal as backdoor

Azure password reset

Azure Services Summary

Base services

Azure Service

Could be Called

Use this to...

Like AWS...

Virtual Machines

Servers

Move existing apps to the cloud without changing them. You manage the entire computer.

EC2

Cloud Services

Managed Virtual Machines

Run applications on virtual machines that you don't have to manage, but can partially manage.

Batch

Azure Distributed Processing

Work on a large chunk of data by divvying it up between a whole bunch of machines.

RemoteApp

Remote Desktop for Apps

Expose non-web apps to users. For example, run Excel on your iPad.

AppStream

Web Apps

Web Site Host

Run websites (.NET, Node.js, etc.) without managing anything extra. Scale automatically and easily.

Elastic Beanstalk

Mobile Apps

Mobile App Accelerator

Quickly get an app backend up and running.

Logic Apps

Visio for Doing Stuff

Chain steps together to get stuff done.

API Apps

API Host

Host your API's without any of the management overhead.

API Management

API Proxy

Expose an API and off-load things like billing, authentication, and caching.

API Gateway

Mobile

Azure Service

Could be Called

Use this to...

Like AWS...

Notification Hubs

Notification Blaster

Send notifications to all of your users, or groups of users based on things like zip code. All platforms.

SNS

Mobile Engagement

Mobile Psychic

Track what users are doing in your app, and customize experience based on this data.

Storage

Azure Service

Could be Called

Use this to...

Like AWS...

SQL Database

Azure SQL

Use the power of a SQL Server cluster without having to manage it.

RDS

Document DB

Azure NoSQL

Use an unstructured JSON database without having to manage it.

Dynamo DB

Redis Cache

Easy Cache

Cache files in memory in a scalable way.

Elasticache

Storage Blobs

Cloud File System

Store files, virtual disks, and build other storage services on top of.

S3

Azure Search

Index & Search

Add search capabilities to your website, or index data stored somewhere else.

CloudSearch

SQL Data Warehouse

Structured Report Database

Store all of your company's data in a structured format for reporting.

RedShift

Azure Data Lake

Unstructured Report Database

Store all of your company's data in any format for reporting.

HDInsight

Hosted Hadoop

Do Hadoopy things with massive amounts of data.

Machine Learning

Skynet

Train AI to predict the future using existing data. Examples include credit card fraud detection and Netflix movie recommendations.

Stream Analytics

Real-time data query

Look for patterns in data as it arrives.

Data Factory

Azure ETL

Orchestrate extract, transform, and load data processes.

Data Pipeline

Event Hubs

IoT Ingestor

Ingest data at ANY scale inexpensively.

Networking

Azure Service

Could be Called

Use this to...

Like AWS...

Virtual Network

Private Network

Put machines on the same, private network so that they talk to each other directly and privately. Expose services to the internet as needed.

ExpressRoute

Fiber to Azure

Connect privately over an insanely fast pipe to an Azure datacenter. Make your local network part of your Azure network.

Direct Connect

Load Balancer

Load Balancer

Split load between multiple services, and handle failures.

Traffic Manager

Datacenter Load Balancer

Split load between multiple datacenters, and handle datacenter outages.

DNS

DNS Provider

Run a DNS server so that your domain names map to the correct IP addresses.

Route53

VPN Gateway

Virtual Fiber to Azure

Connect privately to an Azure datacenter. Make your local network part of your Azure network.

Application Gateway

Web Site Proxy

Proxy all of your HTTP traffic. Host your SSL certs. Load balance with sticky sessions.

CDN

CDN

Make your sites faster and more scalable by putting your static files on servers around the world close to your end users.

Cloudfront

Media Services

Video Processor

Transcode video and distribute and manage it on the scale of the Olympics.

Elastic Transcoder

Management

Azure Service

Could be Called

Use this to...

Like AWS...

Azure Resource Manager

Declarative Configuration

Define your entire Azure architecture as a repeatable JSON file and deploy all at once.

CloudFormation

Developer

Azure Service

Could be Called

Use this to...

Like AWS...

Application Insights

App Analytics

View detailed information about how your apps (web, mobile, etc.) are used.

Mobile Analytics

Service Fabric

Cloud App Framework

Build a cloud optimized application that can scale and handle failures inexpensively.

PreviousAWSNextGCP

Last updated

Was this helpful?