Az - AzureAD (AAD)
Jifunze na zoezi la Kuvamia AWS:
Mafunzo ya HackTricks ya Timu Nyekundu ya AWS (ARTE)
Jifunze na zoezi la Kuvamia GCP: 
Mafunzo ya HackTricks ya Timu Nyekundu ya GCP (GRTE)
Taarifa Msingi
Azure Active Directory (Azure AD) inatumika kama huduma ya msingi ya Microsoft kwa usimamizi wa kitambulisho na ufikiaji wa rasilimali kwenye wingu. Ni muhimu katika kuwezesha wafanyakazi kuingia na kupata rasilimali, ndani na nje ya shirika, ikiwa ni pamoja na Microsoft 365, mlango wa Azure, na programu nyingi za SaaS. Ubunifu wa Azure AD unazingatia kutoa huduma muhimu za kitambulisho, ikiwa ni pamoja na uthibitishaji, idhini, na usimamizi wa mtumiaji.
Sifa muhimu za Azure AD ni pamoja na uthibitishaji wa hatua nyingi na ufikiaji wa hali ya hewa, pamoja na ushirikiano wa moja kwa moja na huduma zingine za usalama za Microsoft. Sifa hizi zinaongeza sana usalama wa vitambulisho vya watumiaji na kuwawezesha mashirika kutekeleza na kusimamia sera zao za ufikiaji kwa ufanisi. Kama sehemu muhimu ya mfumo wa huduma za wingu za Microsoft, Azure AD ni muhimu kwa usimamizi wa vitambulisho vya watumiaji kwenye wingu.
Entititi
Urambazaji
Kwa urambazaji huu unaweza kutumia zana ya az cli, moduli ya PowerShell AzureAD (au AzureAD Preview) na moduli ya Az PowerShell.
Kwenye linux utahitaji kusakinisha PowerShell Core:
Tofauti za Moduli
AzureAD ni moduli ya PowerShell kutoka Microsoft kwa kusimamia Azure AD. Haioneshi mali zote za vitu vya Azure AD na haiwezi kutumika kupata habari za rasilimali za Azure.
Az PowerShell ni moduli ya kusimamia rasilimali za Azure kutoka kwenye mstari wa amri wa PowerShell.
Unganisho
Unapojisajili kupitia CLI kwenye Azure na programu yoyote, unatumia Programu ya Azure kutoka kwa mpangaji ambayo inamilikiwa na Microsoft. Programu hizi, kama ile unayoweza kuunda kwenye akaunti yako, ina kitambulisho cha mteja. Hautaweza kuziona zote kwenye orodha ya programu zilizoruhusiwa unazoweza kuona kwenye konsoli, lakini zinaruhusiwa kwa chaguo-msingi.
Kwa mfano, scripti ya powershell inayotumia programu yenye kitambulisho cha mteja 1950a258-227b-4e31-a9cf-717495945fc2. Hata kama programu haionekani kwenye konsoli, msimamizi wa mfumo anaweza kuzuia programu hiyo ili watumiaji wasiweze kupata upatikanaji kwa kutumia zana zinazounganisha kupitia programu hiyo.
Hata hivyo, kuna vitambulisho vingine vya wateja vya programu ambavyo vitakuruhusu kuunganisha kwenye Azure:
Watumiaji
Azure AD
Azure AD ina jukumu muhimu katika usalama wa mfumo wa Azure. Inashughulikia uthibitishaji, idara, udhibiti wa upatikanaji, na zaidi. Kwa hivyo, wakati wa kufanya upimaji wa usalama kwenye Azure, ni muhimu kuzingatia maeneo haya ya Azure AD.
Uthibitishaji wa Multi-Factor (MFA)
Kuangalia ikiwa MFA imezimwa kwa watumiaji wote au kwa watumiaji fulani tu. Kwa kuongezea, jaribu kubaini ikiwa kuna njia za kuzunguka MFA.
Vibali vya Programu
Hakikisha vibali vya programu vinavyotumiwa na programu zinazounganishwa na Azure AD vimebainishwa vizuri na kuna udhibiti sahihi juu ya vibali hivyo.
Ufuatiliaji wa Usalama
Hakikisha ufuatiliaji wa usalama umeamilishwa kwa Azure AD ili kugundua shughuli zisizotarajiwa au za kutiliwa shaka.
Usimamizi wa Kifaa
Angalia jinsi vifaa vinavyoingia kwenye Azure AD vinavyosimamiwa na kuhakikisha sera za usalama zinatekelezwa ipasavyo.
Usimamizi wa Kitambulisho
Hakikisha sera za usimamizi wa kitambulisho zimeboreshwa na kutekelezwa kwa usahihi kuzuia vitisho vya usalama.
Usimamizi wa Upatikanaji
Hakikisha udhibiti wa upatikanaji umewekwa kwa usahihi kuzuia ufikiaji usiohitajika kwenye Azure AD.
Usalama wa Data
Hakikisha data inayohifadhiwa kwenye Azure AD inalindwa ipasavyo na hatua sahihi za usalama zimechukuliwa.
Usalama wa Mtandao
Thibitisha kuwa Azure AD imefungwa kwa usalama wa hali ya juu kuzuia mashambulizi ya kimtandao.
Usalama wa Maombi
Hakikisha programu zinazounganishwa na Azure AD zina hatua sahihi za usalama ili kuzuia ukiukwaji wa usalama.
Usalama wa Barua pepe
Thibitisha kuwa barua pepe zinazotumwa kutoka Azure AD zinalindwa na hatua sahihi za usalama zimechukuliwa.
Usalama wa Nenosiri
Hakikisha sera kali za usalama wa nenosiri zimeanzishwa kwa watumiaji wa Azure AD kuzuia matumizi mabaya ya nenosiri.
Usalama wa Usajili
Hakikisha usajili wa watumiaji kwenye Azure AD unafanywa kwa njia salama na kuna udhibiti sahihi wa mchakato wa usajili.
Usalama wa Usimamizi wa Kitambulisho
Hakikisha usimamizi wa kitambulisho kwenye Azure AD unafanywa kwa usahihi ili kuzuia upatikanaji usiohitajika au wa kutiliwa shaka.
Usalama wa Ufuatiliaji
Hakikisha ufuatiliaji wa shughuli za Azure AD unafanywa kwa ufanisi ili kugundua na kuzuia vitisho vya usalama kwa wakati unaofaa.
Usalama wa Uthibitishaji
Hakikisha mifumo ya uthibitishaji inayotumiwa na Azure AD inalindwa ipasavyo na kuna mbinu za ziada za uthibitishaji zilizowekwa kwa usalama zaidi.
Usalama wa Uthibitishaji wa Multi-Factor (MFA)
Hakikisha MFA imeanzishwa kwa watumiaji wote kwa kuongeza safu ya ulinzi kwa akaunti za Azure AD.
Usalama wa Uthibitishaji wa Wateja
Hakikisha mifumo ya uthibitishaji wa wateja inayotumiwa na Azure AD inalindwa ipasavyo ili kuzuia ufikiaji usiohitajika au wa kutiliwa shaka.
Usalama wa Uthibitishaji wa Wateja wa Multi-Factor (MFA)
Hakikisha MFA imeanzishwa kwa wateja wote kwa kuongeza safu ya ulinzi kwa akaunti zao za Azure AD.
Usalama wa Uthibitishaji wa Wateja wa Uthibitishaji
Hakikisha mifumo ya uthibitishaji wa wateja inayotumiwa na Azure AD inalindwa ipasavyo na kuna mbinu za ziada za uthibitishaji zilizowekwa kwa usalama zaidi.
Usalama wa Uthibitishaji wa Wateja wa Uthibitishaji wa Multi-Factor (MFA)
Hakikisha MFA imeanzishwa kwa wateja wote kwa kuongeza safu ya ulinzi kwa akaunti zao za Azure AD.
Az PowerShell
Install Az PowerShell Module
To interact with Azure AD using PowerShell, you need to install the Az PowerShell module. You can install the module by running the following command:
Connect to Azure AD
After installing the Az PowerShell module, you can connect to Azure AD using the following command:
This command will prompt you to enter your Azure credentials to authenticate.
List Azure AD Users
You can list all Azure AD users using the following command:
This command will return a list of all users in your Azure AD tenant.
Get Azure AD User
To get information about a specific Azure AD user, you can use the following command:
Replace user@example.com with the user's actual UPN.
Create Azure AD User
You can create a new Azure AD user using the following command:
Replace the values with the user's actual information.
Update Azure AD User
To update an existing Azure AD user, you can use the following command:
Replace the values with the user's actual information.
Remove Azure AD User
To remove an Azure AD user, you can use the following command:
Replace user@example.com with the user's actual UPN.
Badilisha Nenosiri la Mtumiaji
MFA & Sera za Kufikia Zilizowekwa
Inashauriwa sana kuongeza MFA kwa kila mtumiaji, hata hivyo, baadhi ya makampuni hawataki kuweka au wanaweza kuweka na Sera ya Kufikia ya Kigezo: Mtumiaji atahitaji MFA ikiwa ataingia kutoka eneo maalum, kivinjari au hali fulani. Sera hizi, ikiwa hazijasakinishwa kwa usahihi, zinaweza kuwa rahisi kupitishwa. Angalia:
Az - Conditional Access Policies / MFA BypassVikundi
Azure AD
Azure AD ina jukumu muhimu katika usalama wa mfumo wa Azure. Inashughulikia uthibitishaji, idara, udhibiti wa upatikanaji, na zaidi. Kwa hivyo, wakati wa kufanya ukaguzi wa usalama wa Azure, ni muhimu kuzingatia vipengele vya Azure AD kuhakikisha kuwa mifumo yote imeimarishwa ipasavyo.
Uthibitishaji wa Multi-Factor (MFA)
Kuwezesha uthibitishaji wa hatua nyingi (MFA) kwa watumiaji wote ni njia moja ya kuongeza usalama wa akaunti za Azure AD. MFA inahitaji watumiaji kuthibitisha utambulisho wao kupitia njia zaidi ya moja, kama vile simu ya rununu au programu ya uthibitishaji.
Udhibiti wa Upatikanaji
Azure AD inaruhusu udhibiti wa upatikanaji kwa kudhibiti ni watumiaji wangapi wanaweza kupata rasilimali fulani. Kwa kuzingatia na kusanidi vizuri udhibiti wa upatikanaji, unaweza kuzuia ufikiaji usiohitajika kwa data nyeti au mifumo muhimu.
Ufuatiliaji wa Usalama
Kufuatilia shughuli za usalama ndani ya Azure AD ni muhimu kugundua shughuli zisizotarajiwa au za kutiliwa shaka. Kwa kuchambua na kufuatilia kumbukumbu za usalama, unaweza kugundua vitisho mapema na kuchukua hatua za haraka kurekebisha masuala ya usalama.
Usimamizi wa Leseni
Kudumisha usimamizi sahihi wa leseni katika Azure AD ni muhimu kuzuia matumizi yasiyoruhusiwa au ya ziada ya huduma za Azure. Kwa kufuatilia na kusasisha leseni kwa usahihi, unaweza kudhibiti gharama na kuhakikisha utumiaji sahihi wa rasilimali za Azure.
Az PowerShell
Azure Active Directory (Azure AD) cmdlets can be used to manage Azure AD users, groups, and licenses. Here are some common tasks you can perform using Az PowerShell:
Create a new user account
Add a user to a group
Assign a license to a user
Reset a user's password
Disable a user account
To use Az PowerShell for Azure AD management, you need to install the AzureAD module and connect to your Azure AD tenant using the Connect-AzureAD cmdlet.
Once connected, you can start running Azure AD cmdlets to manage your Azure AD resources efficiently.
For more information on Az PowerShell cmdlets for Azure AD, refer to the official documentation.
Ongeza mtumiaji kwa kikundi
Wamiliki wa kikundi wanaweza kuongeza watumiaji wapya kwenye kikundi
Vikundi vinaweza kuwa vya kudumu, ambavyo kimsingi inamaanisha kwamba ikiwa mtumiaji anakidhi hali fulani atapewa kikundi. Bila shaka, ikiwa hali hizo zinategemea vipengele ambavyo mtumiaji anaweza kudhibiti, anaweza kutumia kipengele hiki kuingia katika vikundi vingine. Angalia jinsi ya kutumia vibaya vikundi vya kudumu kwenye ukurasa ufuatao:
Service Principals / Maombi ya Kampuni
Tafadhali kumbuka kwamba Service Principal katika lugha ya PowerShell inaitwa Enterprise Applications kwenye portal ya Azure (wavuti).
Azure AD
Azure AD ina jukumu muhimu katika usalama wa mfumo wa Azure. Inashughulikia uthibitishaji wa watumiaji, usimamizi wa ufikiaji, na udhibiti wa leseni. Kwa kuzingatia hilo, kuchunguza na kufanya upimaji wa usalama kwenye Azure AD ni muhimu sana katika mchakato wa upimaji wa usalama wa mfumo wa Azure.
Az PowerShell
Install Az PowerShell Module
To interact with Azure AD using PowerShell, you need to install the Az PowerShell module. You can install the module by running the following command:
Connect to Azure AD
After installing the Az PowerShell module, you can connect to Azure AD using the following command:
You will be prompted to enter your Azure credentials to authenticate.
List Azure AD Users
To list all the users in Azure AD, you can use the following command:
This will display a list of all the users along with their details.
Get Azure AD User
To get information about a specific user in Azure AD, you can use the following command:
Replace user@example.com with the user's actual UPN.
Create Azure AD User
You can create a new user in Azure AD using the following command:
Replace the values with the user's actual details.
Update Azure AD User
To update an existing user in Azure AD, you can use the following command:
Replace user@example.com with the user's UPN and update the details as needed.
Remove Azure AD User
To remove a user from Azure AD, you can use the following command:
Replace user@example.com with the user's UPN.
Summary
In this section, we have covered how to install the Az PowerShell module, connect to Azure AD, list users, get user information, create a new user, update user details, and remove a user using PowerShell commands.
Mmiliki wa Mwakilishi wa Huduma anaweza kubadilisha nenosiri lake.
Orodhesha na jaribu kuongeza siri ya mteja kwenye kila Programu ya Kampuni
```powershell # Just call Add-AzADAppSecret Function Add-AzADAppSecret { <# .SYNOPSIS Add client secret to the applications.
.PARAMETER GraphToken Pass the Graph API Token
.EXAMPLE PS C:> Add-AzADAppSecret -GraphToken 'eyJ0eX..'
.LINK https://docs.microsoft.com/en-us/graph/api/application-list?view=graph-rest-1.0&tabs=http https://docs.microsoft.com/en-us/graph/api/application-addpassword?view=graph-rest-1.0&tabs=http #>
[CmdletBinding()] param( [Parameter(Mandatory=$True)] [String] $GraphToken = $null )
$AppList = $null $AppPassword = $null
List All the Applications
$Params = @{ "URI" = "https://graph.microsoft.com/v1.0/applications" "Method" = "GET" "Headers" = @{ "Content-Type" = "application/json" "Authorization" = "Bearer $GraphToken" } }
try { $AppList = Invoke-RestMethod @Params -UseBasicParsing } catch { }
Add Password in the Application
if($AppList -ne $null) { [System.Collections.ArrayList]$Details = @()
foreach($App in $AppList.value) { $ID = $App.ID $psobj = New-Object PSObject
$Params = @{ "URI" = "https://graph.microsoft.com/v1.0/applications/$ID/addPassword" "Method" = "POST" "Headers" = @{ "Content-Type" = "application/json" "Authorization" = "Bearer $GraphToken" } }
$Body = @{ "passwordCredential"= @{ "displayName" = "Password" } }
try { $AppPassword = Invoke-RestMethod @Params -UseBasicParsing -Body ($Body | ConvertTo-Json) Add-Member -InputObject $psobj -NotePropertyName "Object ID" -NotePropertyValue $ID Add-Member -InputObject $psobj -NotePropertyName "App ID" -NotePropertyValue $App.appId Add-Member -InputObject $psobj -NotePropertyName "App Name" -NotePropertyValue $App.displayName Add-Member -InputObject $psobj -NotePropertyName "Key ID" -NotePropertyValue $AppPassword.keyId Add-Member -InputObject $psobj -NotePropertyName "Secret" -NotePropertyValue $AppPassword.secretText $Details.Add($psobj) | Out-Null } catch { Write-Output "Failed to add new client secret to '$($App.displayName)' Application." } } if($Details -ne $null) { Write-Output "" Write-Output "Client secret added to : " Write-Output $Details | fl * } } else { Write-Output "Failed to Enumerate the Applications." } }
Azure AD Enumeration
User Enumeration
User enumeration can be performed through the Azure AD login interface. By entering a valid username and observing the response, an attacker can determine if the username is valid or not. This can aid in further attacks such as password spraying or targeted phishing.
Group Enumeration
Group enumeration involves identifying Azure AD groups and their members. This information can be useful for understanding the organization's structure and identifying high-value targets for attacks.
Application Enumeration
Enumerating applications registered in Azure AD can provide insights into the organization's use of third-party services and potential points of compromise.
Device Enumeration
Identifying devices registered in Azure AD can help an attacker understand the devices used within the organization and potentially exploit vulnerabilities associated with these devices.
Role Enumeration
Enumerating roles assigned within Azure AD can reveal privileged accounts and roles within the organization, which can be valuable targets for attackers.
Policy Enumeration
Understanding the policies configured in Azure AD can help an attacker identify security controls in place and potential weaknesses that can be exploited.
Certificate Enumeration
Enumerating certificates used in Azure AD can reveal information about encryption mechanisms and potential weak points in the security infrastructure.
Endpoint Enumeration
Identifying endpoints exposed by Azure AD can help an attacker discover additional entry points into the organization's network and services.
OAuth App Enumeration
Enumerating OAuth applications registered in Azure AD can provide insights into potential authorization vulnerabilities and misconfigurations that could be leveraged in attacks.
Tenant Enumeration
Identifying Azure AD tenants associated with an organization can help an attacker understand the scope of the environment and potential interdependencies between different tenants.
Federation Enumeration
Enumerating federated services integrated with Azure AD can reveal external dependencies and potential attack vectors that could be exploited to compromise the organization's resources.
Risk Enumeration
Understanding the risk factors associated with Azure AD configurations can help an attacker prioritize targets based on the level of risk they pose to the organization's security posture.
Security Enumeration
Enumerating security settings and configurations within Azure AD can help identify gaps in security controls and potential misconfigurations that could be exploited by an attacker.
Logging Enumeration
Identifying logging and monitoring configurations in Azure AD can help an attacker understand the visibility of their actions and potential detection mechanisms in place.
API Enumeration
Enumerating APIs exposed by Azure AD can provide insights into the functionalities available to attackers and potential avenues for unauthorized access to sensitive data or resources.
Synchronization Enumeration
Identifying synchronization configurations in Azure AD can help an attacker understand how user accounts and data are synchronized across different systems and potentially identify weaknesses in the synchronization process.
Privilege Enumeration
Enumerating privileges assigned within Azure AD can help identify accounts with elevated permissions and roles that could be targeted for privilege escalation attacks.
Multi-factor Authentication Enumeration
Enumerating multi-factor authentication settings in Azure AD can help identify accounts protected by MFA and potential bypass techniques that could be used to circumvent this additional security measure.
Password Policy Enumeration
Understanding the password policies enforced in Azure AD can help an attacker identify potential weaknesses in password management practices and exploit them to gain unauthorized access to accounts.
Conditional Access Enumeration
Enumerating conditional access policies in Azure AD can help identify restrictions and controls placed on user access based on specific conditions, providing insights into potential bypass techniques or misconfigurations that could be abused by an attacker.
Sign-In Enumeration
Identifying sign-in configurations and settings in Azure AD can help an attacker understand the authentication mechanisms in place and potential vulnerabilities that could be exploited to gain unauthorized access to user accounts.
Risky Sign-Ins Enumeration
Enumerating risky sign-ins detected by Azure AD can help identify potential security incidents and ongoing attacks targeting the organization's resources, allowing for timely response and mitigation efforts.
Identity Protection Enumeration
Enumerating identity protection policies and configurations in Azure AD can help an attacker understand the measures in place to protect user identities and detect suspicious activities, providing insights into potential weaknesses that could be exploited.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses that could be targeted by attackers attempting to bypass these protections.
Smart Lockout Enumeration
Enumerating smart lockout settings in Azure AD can help identify account lockout policies and mechanisms in place to prevent brute force attacks, providing insights into potential bypass techniques or misconfigurations that could be exploited by an attacker.
Risk Events Enumeration
Enumerating risk events detected by Azure AD can help identify security incidents and suspicious activities that may indicate ongoing attacks or unauthorized access attempts, allowing for prompt investigation and response to mitigate potential risks.
Security Defaults Enumeration
Understanding the security defaults enabled in Azure AD can help identify baseline security settings and potential gaps that may exist in the default configurations, allowing an attacker to focus on exploiting these weaknesses to gain unauthorized access.
Guest User Enumeration
Enumerating guest users in Azure AD can help identify external users with access to the organization's resources and potential entry points that could be leveraged in attacks targeting the guest accounts.
Application Proxy Enumeration
Identifying applications published through Azure AD Application Proxy can help an attacker discover internal applications exposed to the internet and potential misconfigurations that could be exploited to gain unauthorized access to sensitive data or resources.
Password Protection Enumeration
Enumerating password protection settings in Azure AD can help identify additional security measures in place to prevent password-based attacks and potential weaknesses
Az PowerShell
Install Az PowerShell Module
To interact with Azure AD using PowerShell, you need to install the Az PowerShell module. You can install the module by running the following command:
Connect to Azure AD
After installing the Az PowerShell module, you can connect to Azure AD using the following command:
This command will prompt you to enter your Azure credentials to authenticate and establish a connection to Azure AD.
List Azure AD Users
You can list all the users in Azure AD by running the following command:
This command will return a list of all the users in your Azure AD tenant.
Get Azure AD User
To get information about a specific user in Azure AD, you can use the following command:
Replace user@example.com with the user's actual UPN.
Create a New Azure AD User
You can create a new user in Azure AD using the following command:
Replace the values with the user's desired display name, user principal name, and password.
Update Azure AD User
To update an existing Azure AD user's information, you can use the following command:
Replace user@example.com with the user's actual UPN and update the display name as needed.
Remove Azure AD User
To remove a user from Azure AD, you can use the following command:
Replace user@example.com with the user's actual UPN.
Vifaa
Azure AD Enumeration
Azure AD enumeration involves gathering information about users, groups, applications, and permissions within an Azure AD environment. This information can be used to identify potential security weaknesses and plan further attacks.
Tools for Azure AD Enumeration
Azure AD PowerShell Module: Allows you to manage Azure AD users, groups, and applications using PowerShell commands.
Azure AD Graph API: Enables programmatic access to Azure AD through a REST API, allowing you to retrieve information about users, groups, and applications.
Azure AD Explorer: A graphical tool that helps you explore and manipulate Azure AD entities, such as users and groups.
Techniques for Azure AD Enumeration
User Enumeration: Gathering information about Azure AD users, such as usernames, email addresses, and assigned roles.
Group Enumeration: Identifying Azure AD groups and their members to understand the group structure and relationships.
Application Enumeration: Discovering registered applications in Azure AD and their permissions to access resources.
Permission Enumeration: Understanding the permissions assigned to users, groups, and applications within Azure AD.
By performing Azure AD enumeration, pentesters can gain valuable insights into the target Azure AD environment and identify potential security risks.
Ikiwa kifaa (VM) kimejiunga na AzureAD, watumiaji kutoka AzureAD wataweza kuingia. Aidha, ikiwa mtumiaji aliyeingia ni Mmiliki wa kifaa, atakuwa msimamizi wa ndani.
Maombi
Programu ni Usajili wa Programu kwenye portal (sio Maombi ya Kampuni). Lakini kila Usajili wa Programu utaunda Maombi ya Kampuni (Mwakilishi wa Huduma) yenye jina sawa. Aidha, ikiwa Programu ni Programu inayoruhusu wapangaji wengi, Maombi mengine ya Kampuni (Mwakilishi wa Huduma) yataundwa kwenye mpangaji huo na jina sawa.
Wakati Programu inapoundwa aina 2 za ruhusa hupewa:
Ruhusa zilizopewa Mwakilishi wa Huduma
Ruhusa ambazo programu inaweza kuwa nazo na kutumia kwa niaba ya mtumiaji.
Azure AD
Azure AD ina jukumu muhimu katika usalama wa mfumo wa Azure. Inashughulikia uthibitishaji, idara, udhibiti wa upatikanaji, na zaidi. Kwa hivyo, wakati wa kufanya ukaguzi wa usalama wa Azure, ni muhimu kuzingatia maeneo haya kuhakikisha kuwa mifumo yako imehifadhiwa vizuri.
Uthibitishaji wa Multi-Factor (MFA)
Kuwezesha uthibitishaji wa hatua nyingi (MFA) kwa watumiaji wote ni muhimu sana. Hii inasaidia kuzuia ufikiaji usioidhinishwa hata kama nywila zimevuja au zimeibiwa. Hakikisha MFA imeanzishwa kwa watumiaji wote, haswa wale wenye ruhusa za juu au ufikiaji wa data nyeti.
Udhibiti wa Upatikanaji
Tumia sera za udhibiti wa upatikanaji kudhibiti ni nani anayeweza kufanya nini ndani ya Azure AD. Weka viwango vya ufikiaji kulingana na majukumu ya watumiaji ili kupunguza hatari ya ufikiaji usioidhinishwa au matumizi mabaya ya rasilimali.
Ufuatiliaji wa Usalama
Hakikisha kufuatilia shughuli za usalama ndani ya Azure AD. Angalia kwa karibu shughuli za kuingia, mabadiliko ya ruhusa, au shughuli zingine za kutiliwa shaka. Ufuatiliaji wa mara kwa mara utasaidia kugundua haraka vitisho au matumizi mabaya.
Usimamizi wa Kifaa
Tumia zana za usimamizi wa kifaa kudhibiti vifaa vinavyoingia kwenye Azure AD. Weka sera za usalama kama vile kuhitaji vifaa kuthibitishwa kabla ya kupata rasilimali au kuhakikisha vifaa vina programu za usalama zilizosasishwa.
Usimamizi wa Kitambulisho
Hakikisha kusimamia vyeti, funguo, na kitambulisho kingine cha siri kwa uangalifu. Epuka kushiriki sana au kuhifadhi vibadilishaji vya siri kwenye maeneo yasiyofaa. Weka mifumo ya kisasa ya kusimamia kitambulisho ili kuzuia upatikanaji usioidhinishwa.
Hitimisho
Kwa kuzingatia maeneo haya muhimu ya usalama ndani ya Azure AD, unaweza kuboresha sana usalama wa mifumo yako ya Azure na kuzuia vitisho vya usalama. Kumbuka kufanya ukaguzi wa mara kwa mara na kurekebisha mapungufu yoyote haraka iwezekanavyo.
Az PowerShell
Install Az PowerShell Module
To interact with Azure AD using PowerShell, you need to install the Az PowerShell module. You can install the module by running the following command:
Connect to Azure AD
After installing the Az PowerShell module, you can connect to Azure AD using the following command:
This command will prompt you to enter your Azure credentials to authenticate and establish a connection to Azure AD.
List Azure AD Users
Once connected, you can list all the users in Azure AD by running the following command:
This command will return a list of all the users along with their details such as UserPrincipalName, DisplayName, and ObjectId.
Get Azure AD User by UserPrincipalName
You can retrieve a specific user by their UserPrincipalName using the following command:
Replace user@example.com with the actual UserPrincipalName you want to search for.
More Azure AD Operations
The Az PowerShell module provides various cmdlets to perform operations such as creating users, updating user details, resetting passwords, and more in Azure AD. You can explore these cmdlets by referring to the official Az PowerShell documentation.
Programu yenye ruhusa AppRoleAssignment.ReadWrite inaweza kupanda hadhi hadi Msimamizi Mkuu kwa kujipa jukumu hilo.
Kwa maelezo zaidi angalia hii.
Kamba ya siri ambayo programu hutumia kuthibitisha utambulisho wake wakati wa kuomba token ni nenosiri la programu. Kwa hivyo, ukigundua hili nenosiri unaweza kupata ufikiaji kama mkuu wa huduma ndani ya mpangaji. Tafadhali kumbuka kuwa nenosiri hili linaweza kuonekana tu wakati wa kuzalishwa (unaweza kulibadilisha lakini huwezi kulipata tena). Mmiliki wa programu anaweza kuongeza nenosiri kwake (hivyo anaweza kujifanya). Kuingia kama hawa mkuu wa huduma hawatakuwa na alama ya hatari na hawatakuwa na MFA.
Tofauti kati ya Programu na (Programu za Kampuni au Mkuu wa Huduma)
Tofauti kati ya programu na Mkuu wa Huduma katika Azure:
Programu/Viandikishaji vya Programu: Ni programu zilizopo katika Azure AD yako
(Get-AzureADApplication -filter "DisplayName eq 'testapp'")Mkuu wa Huduma/Programu za Kampuni: Vitu vya usalama katika Azure AD yako vinavyoweza kuwa na ruhusa katika Dhibiti la Azure na vimeunganishwa na programu yako au programu ya mtu wa tatu
Get-AzureADServicePrincipal -filter "DisplayName eq 'testapp'")Msimamizi anaweza kuhitaji kupitisha ruhusa zilizotolewa ikiwa ni nyeti sana.
Programu inaweza kuwa ikifanya kazi katika mpangaji wa mtu wa tatu na mara tu unapoanza kutumia na kumpa ufikiaji Programu ya Kampuni/Mkuu wa Huduma inaundwa katika mpangaji wako ili kumpa ufikiaji wa habari anayohitaji:
Vitengo vya Utawala
Inatumika kwa usimamizi bora wa watumiaji.
Vitengo vya utawala vinazuia ruhusa katika jukumu lolote la sehemu yoyote ya shirika lako unayoidhinisha. Unaweza, kwa mfano, kutumia vitengo vya utawala kuweka Msimamizi wa Msaada wa Duka kwa wataalamu wa msaada wa kikanda, ili waweze kusimamia watumiaji tu katika eneo wanalounga mkono.
Kwa hivyo, unaweza kumteua jukumu kwa kitengo cha msimamizi na wanachama wake watapata majukumu haya.
AzureAD
AzureAD is Microsoft's cloud-based identity and access management service. It allows organizations to manage users and provide secure access to resources in the cloud. When conducting security assessments on Azure environments, it is crucial to thoroughly test the configuration of AzureAD to identify any potential vulnerabilities that could be exploited by attackers.
Key areas to focus on when pentesting AzureAD:
User Accounts: Check for weak passwords, unauthorized access, and unusual login activities.
Multi-Factor Authentication (MFA): Test the effectiveness of MFA implementation to prevent unauthorized access.
Privileged Accounts: Review the permissions and activities of privileged accounts to prevent misuse.
Security Policies: Assess the security policies in place and ensure they align with best practices.
Integration: Check for secure integration with other applications and services to prevent data leaks.
By thoroughly examining these key areas, pentesters can help organizations identify and address security issues in their AzureAD configuration.
Azure AD Identity Protection (AIP)
Azure AD Identity Protection (AIP) ni huduma ya usalama inayotumia ugunduzi na urekebishaji wa moja kwa moja kusaidia kulinda utambulisho wa mtumiaji katika Azure Active Directory usidukuliwe. AIP inachunguza na kutathmini hatari za kuingia kwa mtumiaji na mipangilio ya utambulisho, kisha kutumia hatua sahihi za usalama moja kwa moja, kama vile kuhitaji uthibitishaji wa hatua nyingi au kuzuia shughuli hatari. Hii husaidia mashirika kuzuia uvunjaji wa usalama unaotokana na utambulisho.
Mchakato:
Azure AD Identity Protection inachunguza shughuli za mtumiaji na kukusanya data kuhusu kuingia, matukio ya uthibitishaji, na shughuli zingine muhimu.
Huduma hutumia algorithms za machine learning kuchambua data hii na kugundua vitisho vya usalama.
Azure AD Identity Protection inapanga kiwango cha hatari ya tishio (k.m. kuingia) na kutoa tahadhari ikiwa inahitajika kufanya hatua moja kwa moja.
Azure AD Password Protection (APP)
Azure AD Password Protection (APP) ni kipengele cha usalama kinachosaidia kuzuia nywila dhaifu katika Azure Active Directory kwa kutekeleza sera kali za nywila. APP inazuia nywila dhaifu zinazotumiwa mara kwa mara na toleo zake, kupunguza hatari ya uvunjaji unaohusiana na nywila. Inaweza kutumika katika kiwango cha wingu na kwenye Active Directory ya ndani, ikiboresha usalama wa nywila kwa jumla katika shirika.
Marejeo
Jifunze & zoezi Udukuzi wa AWS:Mafunzo ya HackTricks AWS Red Team Expert (ARTE)
Jifunze & zoezi Udukuzi wa GCP: Mafunzo ya HackTricks GCP Red Team Expert (GRTE)
Last updated