oscp/Necronomicon/Cloud/Azure/Reader Permissions/Enumerating with Reader.md

• Enumerating with Reader permissions
  • Simply log in to the Azure portal and view all resources/export to CSV
  • PowerZure
    • Importing the Module will display current role, permissions, and available subscriptions
    • OPSEC NOTE: There are detections in Azure Security Center for this as well as MicroBurst
    • Get-AzureTargets
      • Compares the user role to the Azure scope to enumerate attack surface area
  • MicroBurst
    • Get-AzDomainInfo -Verbose -Folder microburst-output
      • Generates an entire directory dump full of all available info on all of the Azure subscriptions to which the user has access
      • If environment is very large, disable some of the information using the boolean options
  • Review Azure instance metadata (from the instance itself)
    • curl -H Metadata:true --noproxy "*" "http://169.254.169.254/metadata/instance?api-version=2020-09-01" | jq
    • Check for a managed identity
      • curl -H Metadata:true -s 'http://169.254.169.254/metadata/identity/oauth2/ token?api-version=2018-02-01&resource=https%3A%2F%2Fmanag ement.azure.com%2F' | jq
      • Resulting token can be used to interact with the Azure REST APIs. Can also be used with MicroBurst to gather key vault secrets and storage account keys
  • Credential Harvesting
    • Check previous deployments for resource groups
      • Look for misconfigured parameter types - passwords set as "String" instead of "SecureString"
      • Check deployment output sections - can include sensitive values and even "SecureString" values in cleartext
      • Get-AzDomainInfo in MicroBurst gathers all this deployment info; check Development\Resources\Deployments.txt for creds
    • Managed Identities - can have elevated permissions in environment
      • appid=$(az resource list --query "[?name=='\<resource name\>'].identity.principalId" --output tsv)
        • Retrieve resource information and cast to the "appid" variable
      • az role assignment list --assignee $appid --include-groups --include-inherited --query'[].{username:principalName, role:roleDefinitionName, usertype:principalType, scope:scope}'
        • List role assigments, specifying role name, principal name, type, and scope
      • Can also be done with the REST API