julle/oscp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

first commit

Browse Source
This commit is contained in:
julle
2025-11-21 17:17:42 +01:00
commit 4cad18c2a5
285 changed files with 122106 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Necronomicon/Cloud/Azure/Reader Permissions/Enumerating with Reader.md
+27
View File
@@ -0,0 +1,27 @@
- Enumerating with Reader permissions
- Simply log in to the Azure portal and view all resources/export to CSV
- PowerZure
- Importing the Module will display current role, permissions, and available subscriptions
- OPSEC NOTE: There are detections in Azure Security Center for this as well as MicroBurst
- `Get-AzureTargets`
- Compares the user role to the Azure scope to enumerate attack surface area
- MicroBurst
- `Get-AzDomainInfo -Verbose -Folder microburst-output`
- Generates an entire directory dump full of all available info on all of the Azure subscriptions to which the user has access
- If environment is very large, disable some of the information using the boolean options
- Review Azure instance metadata (from the instance itself)
- `curl -H Metadata:true --noproxy "*" "http://169.254.169.254/metadata/instance?api-version=2020-09-01" | jq`
- Check for a managed identity
- `curl -H Metadata:true -s 'http://169.254.169.254/metadata/identity/oauth2/ token?api-version=2018-02-01&resource=https%3A%2F%2Fmanag ement.azure.com%2F' | jq`
- Resulting token can be used to interact with the Azure REST APIs. Can also be used with MicroBurst to gather key vault secrets and storage account keys
- Credential Harvesting
- Check previous deployments for resource groups
- Look for misconfigured parameter types - passwords set as "String" instead of "SecureString"
- Check deployment output sections - can include sensitive values and even "SecureString" values in cleartext
- `Get-AzDomainInfo` in MicroBurst gathers all this deployment info; check Development\\Resources\\Deployments.txt for creds
- Managed Identities - can have elevated permissions in environment
- `appid=$(az resource list --query "[?name=='\<resource name\>'].identity.principalId" --output tsv)`
- Retrieve resource information and cast to the "appid" variable
- `az role assignment list --assignee $appid --include-groups --include-inherited --query'[].{username:principalName, role:roleDefinitionName, usertype:principalType, scope:scope}'`
- List role assigments, specifying role name, principal name, type, and scope
- Can also be done with the REST API