Azure Pentesting
I'M STILL BUILDING THE AZURE METHODOLOGY
Basic Information
Az - Basic InformationAzure Pentester/Red Team Methodology
In order to audit an AZURE environment it's very important to know: which services are being used, what is being exposed, who has access to what, and how are internal Azure services and external services connected.
From a Red Team point of view, the first step to compromise an Azure environment is to manage to obtain some credentials for Azure AD. Here you have some ideas on how to do that:
Leaks in github (or similar) - OSINT
Social Engineering
Password reuse (password leaks)
Vulnerabilities in Azure-Hosted Applications
Server Side Request Forgery with access to metadata endpoint
Local File Read
/home/USERNAME/.azure
C:\Users\USERNAME\.azure
The file
accessTokens.json
inaz cli
before 2.30 - Jan2022 - stored access tokens in clear textThe file
azureProfile.json
contains info about logged user.az logout
removes the token.Older versions of
Az PowerShell
stored access tokens in clear text inTokenCache.dat
. It also stores ServicePrincipalSecret in clear-text inAzureRmContext.json
. The cmdletSave-AzContext
can be used to store tokens. UseDisconnect-AzAccount
to remove them.
3rd parties breached
Internal Employee
Common Phishing (credentials or Oauth App)
Even if you haven't compromised any user inside the Azure tenant you are attacking, you can gather some information from it:
Az - Unauthenticated Enum & Initial EntryAfter you have managed to obtain credentials, you need to know to who do those creds belong, and what they have access to, so you need to perform some basic enumeration:
Basic Enumeration
Remember that the noisiest part of the enumeration is the login, not the enumeration itself.
SSRF
If you found a SSRF in a machine inside Azure check this page for tricks:
Bypass Login Conditions
In cases where you have some valid credentials but you cannot login, these are some common protections that could be in place:
IP whitelisting -- You need to compromise a valid IP
Geo restrictions -- Find where the user lives or where are the offices of the company and get a IP from the same city (or contry at least)
Browser -- Maybe only a browser from certain OS (Windows, Linux, Mac, Android, iOS) is allowed. Find out which OS the victim/company uses.
You can also try to compromise Service Principal credentials as they usually are less limited and its login is less reviewed
After bypassing it, you might be able to get back to your initial setup and you will still have access.
Subdomain Takeover
Whoami
Learn how to install az cli, AzureAD and Az PowerShell in the Az - AzureAD section.
One of the first things you need to know is who you are (in which environment you are):
Oone of the most important commands to enumerate Azure is Get-AzResource
from Az PowerShell as it lets you know the resources your current user has visibility over.
You can get the same info in the web console going to https://portal.azure.com/#view/HubsExtension/BrowseAll or searching for "All resources"
AzureAD Enumeration
By default, any user should have enough permissions to enumerate things such us, users, groups, roles, service principals... (check default AzureAD permissions). You can find here a guide:
Az - AzureAD (AAD)Now that you have some information about your credentials (and if you are a red team hopefully you haven't been detected). It's time to figure out which services are being used in the environment. In the following section you can check some ways to enumerate some common services.
Service Principal and Access Policy
An Azure service can have a System Identity (of the service itself) or use a User Assigned Managed Identity. This Identity can have Access Policy to, for example, a KeyVault to read secrets. These Access Policies should be restricted (least privilege principle), but might have more permissions than required. Typically an App Service would use KeyVault to retrieve secrets and certificates.
So it is useful to explore these identities.
App Service SCM
Kudu console to log in to the App Service 'container'.
Webshell
Use portal.azure.com and select the shell, or use shell.azure.com, for a bash or powershell. The 'disk' of this shell are stored as an image file in a storage-account.
Azure DevOps
Azure DevOps is separate from Azure. It has repositories, pipelines (yaml or release), boards, wiki, and more. Variable Groups are used to store variable values and secrets.
Automated Recon Tools
Last updated