Swahili - Ht Cloud
HackTricks TrainingTwitterLinkedinSponsor

Az - AzureAD (AAD)

Support HackTricks

Basic Information

Azure Active Directory (Azure AD) inatumika kama huduma ya Microsoft ya msingi ya wingu kwa usimamizi wa utambulisho na ufikiaji. Ni muhimu katika kuwezesha wafanyakazi kuingia na kupata rasilimali, ndani na nje ya shirika, ikiwa ni pamoja na Microsoft 365, lango la Azure, na maombi mengine mengi ya SaaS. Muundo wa Azure AD unalenga kutoa huduma muhimu za utambulisho, ikijumuisha uthibitishaji, ruhusa, na usimamizi wa watumiaji.

Vipengele muhimu vya Azure AD vinajumuisha uthibitishaji wa hatua nyingi na ufikiaji wa masharti, pamoja na uunganisho usio na mshono na huduma nyingine za usalama za Microsoft. Vipengele hivi vinainua usalama wa utambulisho wa watumiaji na kuweza kuwezesha mashirika kutekeleza na kutekeleza sera zao za ufikiaji kwa ufanisi. Kama sehemu ya msingi ya mfumo wa huduma za wingu za Microsoft, Azure AD ni muhimu kwa usimamizi wa utambulisho wa watumiaji kwa kutumia wingu.

Entities

Enumeration

Kwa ajili ya kuhesabu hii unaweza kutumia az cli tool, moduli ya PowerShell AzureAD (au AzureAD Preview) na moduli ya Az PowerShell.

In linux you will need to install PowerShell Core:

sudo apt-get update
sudo apt-get install -y wget apt-transport-https software-properties-common

# Ubuntu 20.04
wget -q https://packages.microsoft.com/config/ubuntu/20.04/packages-microsoft-prod.deb

# Update repos
sudo apt-get update
sudo add-apt-repository universe

# Install & start powershell
sudo apt-get install -y powershell
pwsh

# Az cli
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

Tofauti za Moduli

  • AzureAD ni moduli ya PowerShell kutoka Microsoft kwa kusimamia Azure AD. Haionyeshi mali zote za vitu vya Azure AD na haiwezi kutumika kupata taarifa za rasilimali za Azure.

  • Az PowerShell ni moduli kwa kusimamia rasilimali za Azure kutoka kwenye mstari wa amri wa PowerShell.

Muunganisho

az login #This will open the browser
az login -u <username> -p <password> #Specify user and password
az login --identity #Use the current machine managed identity (metadata)
az login --identity -u /subscriptions/<subscriptionId>/resourcegroups/myRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myID #Login with user managed identity
# Login as service principal
az login --service-principal -u http://azure-cli-2016-08-05-14-31-15 -p VerySecret --tenant contoso.onmicrosoft.com #With password
az login --service-principal -u http://azure-cli-2016-08-05-14-31-15 -p ~/mycertfile.pem --tenant contoso.onmicrosoft.com #With cert

# Request access token (ARM)
az account get-access-token
# Request access token for different resource. Supported tokens: aad-graph, arm, batch, data-lake, media, ms-graph, oss-rdbms
az account get-access-token --resource-type aad-graph

# If you want to configure some defaults
az configure

# Get user logged-in already
az ad signed-in-user show

# Help
az find "vm" # Find vm commands
az vm -h # Get subdomains
az ad user list --query-examples # Get examples

Wakati unapo ingia kupitia CLI kwenye Azure na programu yoyote, unatumia Programu ya Azure kutoka tenant inayomilikiwa na Microsoft. Programu hizi, kama zile unazoweza kuunda kwenye akaunti yako, zina kitambulisho cha mteja. Hutaweza kuona zote katika orodha za programu zilizoruhusiwa unazoweza kuona kwenye console, lakini zinaruhusiwa kwa default.

Kwa mfano, script ya powershell inayofanya uthibitishaji inatumia programu yenye kitambulisho cha mteja 1950a258-227b-4e31-a9cf-717495945fc2. Hata kama programu hiyo haitokei kwenye console, msimamizi wa mfumo anaweza kuzuia programu hiyo ili watumiaji wasiweze kufikia kwa kutumia zana zinazounganisha kupitia programu hiyo.

Hata hivyo, kuna vitambulisho vingine vya mteja vya programu ambavyo vitakuruhusu kuungana na Azure:

# The important part is the ClientId, which identifies the application to login inside Azure

$token = Invoke-Authorize -Credential $credential `
-ClientId '1dfb5f98-f363-4b0f-b63a-8d20ada1e62d' `
-Scope 'Files.Read.All openid profile Sites.Read.All User.Read email' `
-Redirect_Uri "https://graphtryit-staging.azurewebsites.net/" `
-Verbose -Debug `
-InformationAction Continue

$token = Invoke-Authorize -Credential $credential `
-ClientId '65611c08-af8c-46fc-ad20-1888eb1b70d9' `
-Scope 'openid profile Sites.Read.All User.Read email' `
-Redirect_Uri "chrome-extension://imjekgehfljppdblckcmjggcoboemlah" `
-Verbose -Debug `
-InformationAction Continue

$token = Invoke-Authorize -Credential $credential `
-ClientId 'd3ce4cf8-6810-442d-b42e-375e14710095' `
-Scope 'openid' `
-Redirect_Uri "https://graphexplorer.azurewebsites.net/" `
-Verbose -Debug `
-InformationAction Continue

Watumiaji

# Enumerate users
az ad user list --output table
az ad user list --query "[].userPrincipalName"
# Get info of 1 user
az ad user show --id "test@corp.onmicrosoft.com"
# Search "admin" users
az ad user list --query "[].displayName" | findstr /i "admin"
az ad user list --query "[?contains(displayName,'admin')].displayName"
# Search attributes containing the word "password"
az ad user list | findstr /i "password" | findstr /v "null,"
# All users from AzureAD
az ad user list --query "[].{osi:onPremisesSecurityIdentifier,upn:userPrincipalName}[?osi==null]"
az ad user list --query "[?onPremisesSecurityIdentifier==null].displayName"
# All users synced from on-prem
az ad user list --query "[].{osi:onPremisesSecurityIdentifier,upn:userPrincipalName}[?osi!=null]"
az ad user list --query "[?onPremisesSecurityIdentifier!=null].displayName"
# Get groups where the user is a member
az ad user get-member-groups --id <email>
# Get roles assigned to the user
az role assignment list --include-groups --include-classic-administrators true --assignee <email>

Badilisha Nenosiri la Mtumiaji

$password = "ThisIsTheNewPassword.!123" | ConvertTo- SecureString -AsPlainText –Force

(Get-AzureADUser -All $true | ?{$_.UserPrincipalName -eq "victim@corp.onmicrosoft.com"}).ObjectId | Set- AzureADUserPassword -Password $password –Verbose

MFA & Sera za Upatikanaji wa Masharti

Inapendekezwa sana kuongeza MFA kwa kila mtumiaji, hata hivyo, baadhi ya kampuni hazitaweka au zinaweza kuweka kwa Upatikanaji wa Masharti: Mtumiaji atakuwa na hitaji la MFA ikiwa ataingia kutoka eneo fulani, kivinjari au hali fulani. Sera hizi, ikiwa hazijapangwa vizuri zinaweza kuwa na uwezekano wa kupitishwa. Angalia:

Vikundi

# Enumerate groups
az ad group list
az ad group list --query "[].[displayName]" -o table
# Get info of 1 group
az ad group show --group <group>
# Get "admin" groups
az ad group list --query "[].displayName" | findstr /i "admin"
az ad group list --query "[?contains(displayName,'admin')].displayName"
# All groups from AzureAD
az ad group list --query "[].{osi:onPremisesSecurityIdentifier,displayName:displayName,description:description}[?osi==null]"
az ad group list --query "[?onPremisesSecurityIdentifier==null].displayName"
# All groups synced from on-prem
az ad group list --query "[].{osi:onPremisesSecurityIdentifier,displayName:displayName,description:description}[?osi!=null]"
az ad group list --query "[?onPremisesSecurityIdentifier!=null].displayName"
# Get members of group
az ad group member list --group <group> --query "[].userPrincipalName" -o table
# Check if member of group
az ad group member check --group "VM Admins" --member-id <id>
# Get which groups a group is member of
az ad group get-member-groups -g "VM Admins"
# Get Apps where a group has a role (role not shown)
Get-AzureADGroup -ObjectId <id> | Get-AzureADGroupAppRoleAssignment | fl *

Ongeza mtumiaji kwenye kundi

Wamiliki wa kundi wanaweza kuongeza watumiaji wapya kwenye kundi

Add-AzureADGroupMember -ObjectId <group_id> -RefObjectId <user_id> -Verbose

Makundi yanaweza kuwa ya kidinamik, ambayo kwa msingi inamaanisha kwamba ikiwa mtumiaji atatimiza masharti fulani atajumuishwa katika kundi. Bila shaka, ikiwa masharti yanategemea sifa ambazo mtumiaji anaweza kudhibiti, anaweza kutumia kipengele hiki vibaya ili kuingia katika makundi mengine. Angalia jinsi ya kutumia vibaya makundi ya kidinamik katika ukurasa ufuatao:

Wawakilishi wa Huduma / Maombi ya Biashara

Kumbuka kwamba Wakilishi wa Huduma katika istilahi ya PowerShell inaitwa Maombi ya Biashara katika lango la Azure (mtandao).

# Get Service Principals
az ad sp list --all
az ad sp list --all --query "[].[displayName]" -o table
# Get details of one SP
az ad sp show --id 00000000-0000-0000-0000-000000000000
# Search SP by string
az ad sp list --all --query "[?contains(displayName,'app')].displayName"
# Get owner of service principal
az ad sp owner list --id <id> --query "[].[displayName]" -o table
# Get service principals owned by the current user
az ad sp list --show-mine
# List apps that have password credentials
az ad sp list --all --query "[?passwordCredentials != null].displayName"
# List apps that have key credentials (use of certificate authentication)
az ad sp list -all --query "[?keyCredentials != null].displayName"

Mmiliki wa Huduma Kuu anaweza kubadilisha nenosiri lake.

Orodha na jaribu kuongeza siri ya mteja kwenye kila Programu ya Biashara

```powershell # Just call Add-AzADAppSecret Function Add-AzADAppSecret { <# .SYNOPSIS Add client secret to the applications.

.PARAMETER GraphToken Pass the Graph API Token

.EXAMPLE PS C:> Add-AzADAppSecret -GraphToken 'eyJ0eX..'

.LINK https://docs.microsoft.com/en-us/graph/api/application-list?view=graph-rest-1.0&tabs=http https://docs.microsoft.com/en-us/graph/api/application-addpassword?view=graph-rest-1.0&tabs=http #>

[CmdletBinding()] param( [Parameter(Mandatory=$True)] [String] $GraphToken = $null )

$AppList = $null $AppPassword = $null

List All the Applications

$Params = @{ "URI" = "https://graph.microsoft.com/v1.0/applications" "Method" = "GET" "Headers" = @{ "Content-Type" = "application/json" "Authorization" = "Bearer $GraphToken" } }

try { $AppList = Invoke-RestMethod @Params -UseBasicParsing } catch { }

Add Password in the Application

if($AppList -ne $null) { [System.Collections.ArrayList]$Details = @()

foreach($App in $AppList.value) { $ID = $App.ID $psobj = New-Object PSObject

$Params = @{ "URI" = "https://graph.microsoft.com/v1.0/applications/$ID/addPassword" "Method" = "POST" "Headers" = @{ "Content-Type" = "application/json" "Authorization" = "Bearer $GraphToken" } }

$Body = @{ "passwordCredential"= @{ "displayName" = "Password" } }

try { $AppPassword = Invoke-RestMethod @Params -UseBasicParsing -Body ($Body | ConvertTo-Json) Add-Member -InputObject $psobj -NotePropertyName "Object ID" -NotePropertyValue $ID Add-Member -InputObject $psobj -NotePropertyName "App ID" -NotePropertyValue $App.appId Add-Member -InputObject $psobj -NotePropertyName "App Name" -NotePropertyValue $App.displayName Add-Member -InputObject $psobj -NotePropertyName "Key ID" -NotePropertyValue $AppPassword.keyId Add-Member -InputObject $psobj -NotePropertyName "Secret" -NotePropertyValue $AppPassword.secretText $Details.Add($psobj) | Out-Null } catch { Write-Output "Failed to add new client secret to '$($App.displayName)' Application." } } if($Details -ne $null) { Write-Output "" Write-Output "Client secret added to : " Write-Output $Details | fl * } } else { Write-Output "Failed to Enumerate the Applications." } }

</details>

### Majukumu

<div data-gb-custom-block data-tag="tabs">

<div data-gb-custom-block data-tag="tab" data-title='az cli'>

```bash
# Get roles
az role definition list
# Get assigned roles
az role assignment list --all --query "[].roleDefinitionName"
az role assignment list --all | jq '.[] | .roleDefinitionName,.scope'
# Get info of 1 role
az role definition list --name "AzureML Registry User"
# Get only custom roles
az role definition list --custom-role-only
# Get only roles assigned to the resource group indicated
az role definition list --resource-group <resource_group>
# Get only roles assigned to the indicated scope
az role definition list --scope <scope>
# Get all the principals a role is assigned to
az role assignment list --all --query "[].{principalName:principalName,principalType:principalType,resourceGroup:resourceGroup,roleDefinitionName:roleDefinitionName}[?roleDefinitionName=='<ROLE_NAME>']"
# Get all available role templates
Get-AzureADDirectoryroleTemplate
# Get enabled roles (Assigned roles)
Get-AzureADDirectoryRole
Get-AzureADDirectoryRole -ObjectId <roleID> #Get info about the role
# Get custom roles - use AzureAdPreview
Get-AzureADMSRoleDefinition | ?{$_.IsBuiltin -eq $False} | select DisplayName
# Users assigned a role (Global Administrator)
Get-AzureADDirectoryRole -Filter "DisplayName eq 'Global Administrator'" | Get-AzureADDirectoryRoleMember
Get-AzureADDirectoryRole -ObjectId <id> | fl
# Roles of the Administrative Unit (who has permissions over the administrative unit and its members)
Get-AzureADMSScopedRoleMembership -Id <id> | fl *
# Get role assignments on the subscription
Get-AzRoleDefinition
# Get Role definition
Get-AzRoleDefinition -Name "Virtual Machine Command Executor"
# Get roles of a user or resource
Get-AzRoleAssignment -SignInName test@corp.onmicrosoft.com
Get-AzRoleAssignment -Scope /subscriptions/<subscription-id>/resourceGroups/<res_group_name>/providers/Microsoft.Compute/virtualMachines/<vm_name>
# Get permissions over a resource using ARM directly
$Token = (Get-AzAccessToken).Token
$URI = 'https://management.azure.com/subscriptions/b413826f-108d-4049-8c11-d52d5d388768/resourceGroups/Research/providers/Microsoft.Compute/virtualMachines/infradminsrv/providers/Microsoft.Authorization/permissions?api-version=2015-07-01'
$RequestParams = @{
Method = 'GET'
Uri = $URI
Headers = @{
'Authorization' = "Bearer $Token"
}
}
(Invoke-RestMethod @RequestParams).value

Vifaa

# If you know how to do this send a PR!# Enumerate DevicesGet-AzureADDevice -All $true | fl *# List all the active devices (and not the stale devices)Get-AzureADDevice -All $true | ?{$_.ApproximateLastLogonTimeStamp -ne $null}# Get owners of all devicesGet-AzureADDevice -All $true | Get-AzureADDeviceRegisteredOwnerGet-AzureADDevice -All $true | %{if($user=Get-AzureADDeviceRegisteredOwner -ObjectId $_.ObjectID){$_;$user.UserPrincipalName;"`n"}}# Registred users of all the devicesGet-AzureADDevice -All $true | Get-AzureADDeviceRegisteredUserGet-AzureADDevice -All $true | %{if($user=Get-AzureADDeviceRegisteredUser -ObjectId $_.ObjectID){$_;$user.UserPrincipalName;"`n"}}# Get dives managed using IntuneGet-AzureADDevice -All $true | ?{$_.IsCompliant -eq "True"}# Get devices owned by a userGet-AzureADUserOwnedDevice -ObjectId test@corp.onmicrosoft.com# Get Administrative Units of a deviceGet-AzureADMSAdministrativeUnit | where { Get-AzureADMSAdministrativeUnitMember -ObjectId $_.ObjectId | where {$_.ObjectId -eq $deviceObjId} }

Ikiwa kifaa (VM) kime unganishwa na AzureAD, watumiaji kutoka AzureAD wataweza kuingia. Zaidi ya hayo, ikiwa mtumiaji aliyeingia ni Mmiliki wa kifaa, atakuwa meneja wa ndani.

Maombi

Maombi ni Usajili wa Maombi katika lango (sio Maombi ya Biashara). Lakini kila Usajili wa Maombi utaunda Maombi ya Biashara (Huduma Kuu) yenye jina sawa. Zaidi ya hayo, ikiwa Programu ni programu ya wapangaji wengi, programu nyingine ya Biashara (Huduma Kuu) itaundwa katika wapangaji hao yenye jina sawa.

Wakati Programu inaundwa, aina 2 za ruhusa hutolewa:

  • Ruhusa zinazotolewa kwa Huduma Kuu

  • Ruhusa ambazo programu inaweza kuwa nazo na kutumia kwa ni ni kwa niaba ya mtumiaji.

# List Appsaz ad app listaz ad app list --query "[].[displayName]" -o table# Get info of 1 Appaz ad app show --id 00000000-0000-0000-0000-000000000000# Search App by stringaz ad app list --query "[?contains(displayName,'app')].displayName"# Get the owner of an applicationaz ad app owner list --id <id> --query "[].[displayName]" -o table# List all the apps with an application passwordaz ad app list --query "[?passwordCredentials != null].displayName"# List apps that have key credentials (use of certificate authentication)az ad app list --query "[?keyCredentials != null].displayName"# List all registered applicationsGet-AzureADApplication -All $true# Get details of an applicationGet-AzureADApplication -ObjectId <id> | fl *# List all the apps with an application passwordGet-AzureADApplication -All $true | %{if(Get-AzureADApplicationPasswordCredential -ObjectID $_.ObjectID){$_}}# Get owner of an applicationGet-AzureADApplication -ObjectId <id> | Get-AzureADApplicationOwner |fl *# Get AppsGet-AzADApplication# Get details of one AppGet-AzADApplication -ObjectId <id># Get App searching by stringGet-AzADApplication | ?{$_.DisplayName -match "app"}# Get Apps with passwordGet-AzADAppCredential

Programu yenye ruhusa AppRoleAssignment.ReadWrite inaweza kuinua hadhi kuwa Msimamizi wa Global kwa kujipatia nafasi hiyo. Kwa maelezo zaidi angalia hii.

Mstari wa siri ambao programu inatumia kuthibitisha utambulisho wake wakati wa kuomba token ni nenosiri la programu. Hivyo, ukipata nenosiri hili unaweza kufikia kama mwakilishi wa huduma ndani ya tenant. Kumbuka kwamba nenosiri hili linaonekana tu wakati linapotengenezwa (unaweza kulibadilisha lakini huwezi kulipata tena). Mmiliki wa programu anaweza kuongeza nenosiri kwake (ili aweze kujifanya kuwa hiyo). Kuingia kama wakilishi hawa wa huduma hakutajwi kama hatari na hawatakuwa na MFA.

Tofauti kati ya Programu & (Programu za Biashara au Wawakilishi wa Huduma)

Tofauti kati ya programu na Wawakilishi wa Huduma katika Azure:

  • Usajili wa Programu/App: Ni programu ambazo zipo katika Azure AD yako

  • (Get-AzureADApplication -filter "DisplayName eq 'testapp'")

  • Wawakilishi wa Huduma/Programu za Biashara: Vitu vya usalama katika Azure AD yako ambavyo vinaweza kuwa na haki katika Katalogi ya Azure na vinahusishwa na programu yako au programu ya mtu wa tatu

  • Get-AzureADServicePrincipal -filter "DisplayName eq 'testapp'")

  • Msimamizi anaweza kuhitajika kuidhinisha ruhusa zilizotolewa ikiwa ni nyeti sana.

Programu inaweza kuwa inafanya kazi katika tenant ya mtu wa tatu na mara tu unapoanza kuitumia na kuipa ufikiaji, Programu ya Biashara/Wawakilishi wa Huduma inaundwa katika tenant yako ili kuipa ufikiaji wa taarifa inazohitaji:

Vitengo vya Utawala

Vinatumika kwa usimamizi bora wa watumiaji.

Vitengo vya utawala vinapunguza ruhusa katika nafasi kwa sehemu yoyote ya shirika lako ambayo unafafanua. Unaweza, kwa mfano, kutumia vitengo vya utawala kuhamasisha nafasi ya Msimamizi wa Huduma kwa wataalamu wa msaada wa kikanda, ili waweze kusimamia watumiaji tu katika eneo ambalo wanasaidia.

Hivyo, unaweza kupewa nafasi kwa kitengo cha msimamizi na wanachama wake watakuwa na nafasi hizi.

# Get Administrative UnitsGet-AzureADMSAdministrativeUnitGet-AzureADMSAdministrativeUnit -Id <id># Get ID of admin unit by string$adminUnitObj = Get-AzureADMSAdministrativeUnit -Filter "displayname eq 'Test administrative unit 2'"# List the users, groups, and devices affected by the administrative unitGet-AzureADMSAdministrativeUnitMember -Id <id># Get the roles users have over the members of the AUGet-AzureADMSScopedRoleMembership -Id <id> | fl #Get role ID and role members

Azure AD Identity Protection (AIP)

Azure AD Identity Protection (AIP) ni huduma ya usalama inayotumia ugunduzi wa kiotomatiki na urejeleaji kusaidia kulinda vitambulisho vya watumiaji katika Azure Active Directory kutokana na kuathirika. AIP inafuatilia na kutathmini hatari ya kuingia kwa watumiaji na mipangilio ya vitambulisho, ikiweka hatua za usalama zinazofaa kiotomatiki, kama vile kuhitaji uthibitisho wa hatua nyingi au kuzuia shughuli zinazoweza kuwa hatari. Hii inasaidia mashirika kuzuia uvunjaji wa usalama unaotokana na vitambulisho.

Mchakato:

  1. Azure AD Identity Protection inafuatilia shughuli za watumiaji na kukusanya data kuhusu kuingia kwa watumiaji, matukio ya uthibitisho, na shughuli nyingine muhimu.

  2. Huduma hii inatumia algorithms za kujifunza mashine kuchambua data hii na kugundua vitisho vya usalama vinavyoweza kutokea.

  3. Azure AD Identity Protection inaweka kiwango cha hatari kwa tishio (mfano, kuingia) na kuunda arifa ikiwa inahitajika kufanya hatua fulani kiotomatiki.

Azure AD Password Protection (APP)

Azure AD Password Protection (APP) ni kipengele cha usalama ambacho kisaidia kuzuia nywila dhaifu katika Azure Active Directory kwa kutekeleza sera za nywila kali. APP inazuia nywila dhaifu zinazotumiwa mara kwa mara na toleo lake, kupunguza hatari ya uvunjaji unaohusiana na nywila. Inaweza kutumika katika kiwango cha wingu na kwenye Active Directory ya ndani, ikiongeza usalama wa jumla wa nywila katika shirika.

References

PreviousAz - Device RegistrationNextAz - Conditional Access Policies / MFA Bypass

Last updated