Comment on page
Az - Unauthenticated Enum & Initial Entry
There are some public Azure APIs that just knowing the domain of the tenant an attacker could query to gather more info about it. You can query directly the API or use the PowerShell library AADInternals:
Invoke-AADIntReconAsOutsider -DomainName corp.onmicrosoft.com | Format-Table
Output Example of the Azure tenant info:
Tenant brand: Company Ltd
Tenant name: company
Tenant id: 05aea22e-32f3-4c35-831b-52735704feb3
DesktopSSO enabled: True
Name DNS MX SPF Type STS
---- --- -- --- ---- ---
company.com True True True Federated sts.company.com
company.mail.onmicrosoft.com True True True Managed
company.onmicrosoft.com True True True Managed
int.company.com False False False Managed
From the output we can see the tenant information of the target organisation, including the tenant name, id and the “brand” name. We can also see whether the Desktop SSO (aka Seamless SSO) is enabled. If enabled, we can find out whether a given user exists in the target organisation or not (user enumeration).
We can also see the names of all (verified) domains and their identity types of the target tenant. For federated domains, the FQDN of the used identity provider (usually ADFS server) is also shown. The MX column indicates whether the email is send to Exchange online or not. The SPF column indicates whether Exchange online is listed as an email sender. Note! Currently the recon function does not follow the include statements of SPF records, so there can be false-negatives.
It's possible to check if a username exists inside a tenant. This includes also guest users, whose username is in the format:
The email is user’s email address where at “@” is replaced with underscore “_“.
You can also use a text file containing one email address per row:
# Invoke user enumeration
Get-Content .\users.txt | Invoke-AADIntUserEnumerationAsOutsider -Method Normal
There are three different enumeration methods to choose from:
After discovering the valid usernames you can get info about a user with:
Get-AADIntLoginInformation -UserName email@example.com
Know that we know the domains the Azure tenant is using is time to try to find Azure services exposed.
Import-Module .\MicroBurst\MicroBurst.psm1 -Verbose
Invoke-EnumerateAzureSubDomains -Base corp -Verbose
You could discover open storage with a tool such as InvokeEnumerateAzureBlobs.ps1 which will use the file
Microburst/Misc/permitations.txtto generate permutations (very simple) to try to find open storage accounts.
Invoke-EnumerateAzureBlobs -Base corp
# Access https://corpcommon.blob.core.windows.net/secrets?restype=container&comp=list
# Check: <Name>ssh_info.json</Name>
# Access then https://corpcommon.blob.core.windows.net/secrets/ssh_info.json
A shared access signature (SAS) URL is an URL that provides access to certain part of a Storage account (could be a full container, a file...) with some specific permissions (read, write...) over the resources. If you find one leaked you could be able to access sensitive information, they look like this (this is to access a container, if it was just granting access to a file the path of the URL will also contain that file):