Azure Pentesting
NINAENDELEA KUJENGA METHODOLOGY YA AZURE
Taarifa Msingi
pageAz - Basic InformationAzure Pentester/Red Team Methodology
Ili kukagua mazingira ya AZURE ni muhimu kujua: ni huduma zipi zinazotumiwa, nini kinachoonekana, nani ana upatikanaji wa nini, na jinsi huduma za Azure za ndani na huduma za nje zinavyounganishwa.
Kutoka mtazamo wa Timu Nyekundu, hatua ya kwanza ya kudukua mazingira ya Azure ni kufanikiwa kupata vitambulisho vya Azure AD. Hapa kuna mawazo kadhaa jinsi ya kufanya hivyo:
Kuvuja kwenye github (au sawa) - OSINT
Uhandisi wa Kijamii
Kutumia tena nywila (kuvuja kwa nywila)
Udhaifu katika Maombi Yaliyohifadhiwa kwenye Azure
Server Side Request Forgery na upatikanaji wa mwisho wa metadata
Soma Faili za Ndani
/home/USERNAME/.azure
C:\Users\USERNAME\.azure
Faili ya
accessTokens.json
katikaaz cli
kabla ya 2.30 - Jan2022 - ilihifadhi vitambulisho vya upatikanaji kwa maandishi waziFaili ya
azureProfile.json
ina habari kuhusu mtumiaji aliyeingia.az logout
inaondoa kibali.Toleo za zamani za
Az PowerShell
zilizohifadhi vitambulisho vya upatikanaji kwa maandishi wazi katikaTokenCache.dat
. Pia inahifadhi ServicePrincipalSecret kwa maandishi wazi katikaAzureRmContext.json
. AmriSave-AzContext
inaweza kutumika kuhifadhi vitambulisho. TumiaDisconnect-AzAccount
kuziondoa.3rd parties zilizovunjika
Mfanyakazi wa Ndani
Udukuzi wa Kawaida (vitambulisho au Programu ya Oauth)
Hata kama hujadukua mtumiaji yeyote ndani ya mpangaji wa Azure unao shambulia, unaweza kukusanya habari fulani kutoka kwake:
pageAz - Unauthenticated Enum & Initial EntryBaada ya kufanikiwa kupata vitambulisho, unahitaji kujua vitambulisho hivyo ni vya nani, na wanayo upatikanaji wa nini, hivyo unahitaji kufanya uchambuzi wa msingi:
Uchambuzi wa Msingi
Kumbuka kuwa sehemu yenye kelele zaidi ya uchambuzi ni kuingia, sio uchambuzi yenyewe.
SSRF
Ikiwa umepata SSRF kwenye mashine ndani ya Azure angalia ukurasa huu kwa mbinu:
Kupuuza Masharti ya Kuingia
Katika kesi ambapo una vitambulisho halali lakini huwezi kuingia, hizi ni baadhi ya ulinzi wa kawaida ambao unaweza kuwa mahali:
Kuweka orodha nyeupe ya IP -- Unahitaji kudukua IP halali
Vikwazo vya Jiografia -- Pata mahali ambapo mtumiaji anaishi au ofisi za kampuni na pata IP kutoka jiji hilo (au nchi angalau)
Kivinjari -- Labda kivinjari kutoka kwa OS fulani (Windows, Linux, Mac, Android, iOS) kinaruhusiwa. Gundua ni OS ipi mtumiaji/kampuni inatumia.
Unaweza pia kujaribu kudukua vitambulisho vya Mwanzilishi wa Huduma kwani kawaida vina vikwazo vichache na kuingia kwake kunachunguzwa kidogo
Baada ya kuvuka hilo, unaweza kurudi kwenye usanidi wako wa awali na bado utakuwa na upatikanaji.
Kuchukua Subdomain
Whoami
Jifunze jinsi ya kusakinisha az cli, AzureAD na Az PowerShell katika sehemu ya Az - AzureAD.
Moja ya mambo ya kwanza unayohitaji kujua ni wewe ni nani (katika mazingira gani uko):
AzureAD
Enumeration
User Enumeration: Enumerate users through the Graph API or the Azure Portal.
Group Enumeration: Enumerate groups through the Graph API or the Azure Portal.
Application Enumeration: Enumerate applications through the Graph API or the Azure Portal.
Brute Force
Password Spraying: Perform password spraying attacks against Azure AD accounts.
Credential Stuffing: Use known username and password combinations to gain unauthorized access.
Exploitation
Phishing: Conduct phishing attacks to steal user credentials.
Token Impersonation: Obtain and abuse tokens to impersonate users.
Password Policies: Exploit weak password policies to gain unauthorized access.
Persistence
Backdoors: Create backdoors in Azure AD for persistent access.
Service Principals: Abuse service principals for persistent access.
Lateral Movement
OAuth Token Abuse: Abuse OAuth tokens to move laterally within Azure AD.
Application Permissions: Abuse application permissions to move laterally within Azurejson AD.
Data Exfiltration
Export Data: Export sensitive data from Azure AD using various methods.
Application Consent: Abuse application consent to exfiltrate data.
Covering Tracks
Audit Logs: Clear or modify audit logs to hide malicious activities.
Token Cleanup: Clean up tokens to remove traces of unauthorized access.
Az PowerShell
Azure PowerShell is a module that provides cmdlets to manage Azure resources directly from the PowerShell command line. It allows for automation and scripting of various Azure tasks, making it a powerful tool for managing Azure environments.
Installation
To install the Azure PowerShell module, you can use the following command:
Connecting to Azure
You can connect to your Azure account using the Connect-AzAccount
cmdlet. This will prompt you to log in with your Azure credentials and establish a connection to your Azure subscription.
Managing Azure Resources
Once connected, you can use various cmdlets to manage Azure resources. For example, you can create a new resource group using the New-AzResourceGroup
cmdlet:
Scripting and Automation
Azure PowerShell allows you to script and automate various tasks, such as deploying resources, configuring settings, and managing Azure services. By combining cmdlets in scripts, you can streamline your Azure management processes.
Summary
Azure PowerShell is a powerful tool for managing Azure resources through the command line. By leveraging its cmdlets, you can automate tasks, streamline processes, and efficiently manage your Azure environment.
Moja ya amri muhimu sana ya kuchunguza Azure ni Get-AzResource
kutoka Az PowerShell kwani inakuruhusu kujua rasilimali ambazo mtumiaji wako wa sasa ana uwezo wa kuziona.
Unaweza kupata habari sawa katika konsoli ya wavuti kwa kwenda https://portal.azure.com/#view/HubsExtension/BrowseAll au kutafuta "All resources"
Uchunguzi wa AzureAD
Kwa chaguo-msingi, mtumiaji yeyote anapaswa kuwa na idhini za kutosha za kuchunguza mambo kama vile, watumiaji, vikundi, majukumu, wakala wa huduma... (angalia idhini za chaguo-msingi za AzureAD). Unaweza kupata mwongozo hapa:
pageAz - AzureAD (AAD)Sasa kwamba una habari kuhusu vibali vyako (na kama wewe ni timu nyekundu kwa matumaini haujagunduliwa). Ni wakati wa kubaini ni huduma zipi zinazotumiwa katika mazingira. Katika sehemu ifuatayo unaweza kuangalia njia kadhaa za kuchunguza huduma za kawaida.
Mwakilishi wa Huduma na Sera ya Kufikia
Huduma ya Azure inaweza kuwa na Kitambulisho cha Mfumo (cha huduma yenyewe) au kutumia Kitambulisho cha Usimamizi kilichopewa Mtumiaji. Kitambulisho hiki kinaweza kuwa na Sera ya Kufikia, kwa mfano, kwa KeyVault ili kusoma siri. Sera hizi za Kufikia zinapaswa kuwa zimezuiliwa (kanuni ya idhini ndogo), lakini zinaweza kuwa na idhini zaidi kuliko inavyohitajika. Kwa kawaida Huduma ya Programu ingetumia KeyVault kupata siri na vyeti.
Hivyo ni muhimu kuchunguza vitambulisho hivi.
Konsoli ya App Service SCM
Konsoli ya Kudu kuingia kwenye 'kontena' la Huduma ya Programu.
Webshell
Tumia portal.azure.com na chagua shell, au tumia shell.azure.com, kwa bash au powershell. 'Diski' ya kishell hiki imehifadhiwa kama faili ya picha katika akaunti ya uhifadhi.
Azure DevOps
Azure DevOps ni tofauti na Azure. Ina hazina, mabomba (yaml au kutolewa), bodi, wiki, na zaidi. Vikundi vya Vigezo hutumiwa kuhifadhi thamani za vigezo na siri.
Zana za Uchunguzi wa Kiotomatiki
Last updated