27 lines
2.2 KiB
Markdown
27 lines
2.2 KiB
Markdown
- Enumerating with Reader permissions
|
|
- Simply log in to the Azure portal and view all resources/export to CSV
|
|
- PowerZure
|
|
- Importing the Module will display current role, permissions, and available subscriptions
|
|
- OPSEC NOTE: There are detections in Azure Security Center for this as well as MicroBurst
|
|
- `Get-AzureTargets`
|
|
- Compares the user role to the Azure scope to enumerate attack surface area
|
|
- MicroBurst
|
|
- `Get-AzDomainInfo -Verbose -Folder microburst-output`
|
|
- Generates an entire directory dump full of all available info on all of the Azure subscriptions to which the user has access
|
|
- If environment is very large, disable some of the information using the boolean options
|
|
- Review Azure instance metadata (from the instance itself)
|
|
- `curl -H Metadata:true --noproxy "*" "http://169.254.169.254/metadata/instance?api-version=2020-09-01" | jq`
|
|
- Check for a managed identity
|
|
- `curl -H Metadata:true -s 'http://169.254.169.254/metadata/identity/oauth2/ token?api-version=2018-02-01&resource=https%3A%2F%2Fmanag ement.azure.com%2F' | jq`
|
|
- Resulting token can be used to interact with the Azure REST APIs. Can also be used with MicroBurst to gather key vault secrets and storage account keys
|
|
- Credential Harvesting
|
|
- Check previous deployments for resource groups
|
|
- Look for misconfigured parameter types - passwords set as "String" instead of "SecureString"
|
|
- Check deployment output sections - can include sensitive values and even "SecureString" values in cleartext
|
|
- `Get-AzDomainInfo` in MicroBurst gathers all this deployment info; check Development\\Resources\\Deployments.txt for creds
|
|
- Managed Identities - can have elevated permissions in environment
|
|
- `appid=$(az resource list --query "[?name=='\<resource name\>'].identity.principalId" --output tsv)`
|
|
- Retrieve resource information and cast to the "appid" variable
|
|
- `az role assignment list --assignee $appid --include-groups --include-inherited --query'[].{username:principalName, role:roleDefinitionName, usertype:principalType, scope:scope}'`
|
|
- List role assigments, specifying role name, principal name, type, and scope
|
|
- Can also be done with the REST API |