Az - Unauthenticated Enum & Initial Entry

Jifunze kuhusu udukuzi wa AWS kutoka sifuri hadi shujaa na htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)!

Njia nyingine za kusaidia HackTricks:

• Ikiwa unataka kuona kampuni yako ikitangazwa kwenye HackTricks au kupakua HackTricks kwa PDF Angalia MIPANGO YA USAJILI!

• Pata bidhaa rasmi za PEASS & HackTricks

• Gundua Familia ya PEASS, mkusanyiko wetu wa NFTs ya kipekee

• Jiunge na 💬 Kikundi cha Discord au kikundi cha telegram au tufuate kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.

Azure Tenant

Uthibitishaji wa Tenant

Kuna Azure APIs za umma ambazo kwa kujua tu uwanja wa tenant mshambuliaji anaweza kuuliza ili kukusanya habari zaidi kuhusu hilo. Unaweza kuuliza moja kwa moja API au kutumia maktaba ya PowerShell AADInternals:

API	Taarifa	Kazi ya AADInternals
login.microsoftonline.com/<domain>/.well-known/openid-configuration	Taarifa ya kuingia, ikiwa ni pamoja na kitambulisho cha tenant	Get-AADIntTenantID -Domain <domain>
autodiscover-s.outlook.com/autodiscover/autodiscover.svc	Majina yote ya uwanja wa tenant	Get-AADIntTenantDomains -Domain <domain>
login.microsoftonline.com/GetUserRealm.srf?login=<UserName>	Taarifa ya kuingia ya tenant, ikiwa ni pamoja na Jina la tenant na uwanja wa aina ya uthibitishaji. Ikiwa Aina ya Nafasi ni Imeandaliwa, inamaanisha AzureAD inatumika.	Get-AADIntLoginInformation -UserName <UserName>
login.microsoftonline.com/common/GetCredentialType	Taarifa ya kuingia, ikiwa ni pamoja na taarifa ya Desktop SSO	Get-AADIntLoginInformation -UserName <UserName>

Unaweza kuuliza taarifa zote za tenant wa Azure kwa amri moja tu ya AADInternals maktaba:

Invoke-AADIntReconAsOutsider -DomainName corp.onmicrosoft.com | Format-Table

Mfano wa Matokeo ya Taarifa ya Mpangaji wa Azure:

Tenant brand:       Company Ltd
Tenant name:        company
Tenant id:          1937e3ab-38de-a735-a830-3075ea7e5b39
DesktopSSO enabled: True

Name                           DNS   MX    SPF  Type      STS
----                           ---   --    ---  ----      ---
company.com                   True  True  True  Federated sts.company.com
company.mail.onmicrosoft.com  True  True  True  Managed
company.onmicrosoft.com       True  True  True  Managed
int.company.com              False False False  Managed

Niwezekana kuona maelezo kuhusu jina la mpangaji, kitambulisho, na jina la "brand". Aidha, hali ya Desktop Single Sign-On (SSO), inayojulikana pia kama Seamless SSO, inaonyeshwa. Wakati ikiruhusiwa, kipengele hiki hufanikisha kujua uwepo (ujumuishaji) wa mtumiaji maalum ndani ya shirika lengwa.

Zaidi ya hayo, matokeo yanatoa majina ya uhalalishaji wa vikoa vyote vilivyothibitishwa vinavyohusiana na mpangaji lengwa, pamoja na aina zao za utambulisho. Katika kesi ya vikoa vilivyofederated, Jina Kamili la Kikoa la Utambulisho (FQDN) la mtoa huduma wa utambulisho unaotumiwa, kwa kawaida seva ya ADFS, pia inafunuliwa. Safu ya "MX" inabainisha ikiwa barua pepe zinapelekwa kwa Exchange Online, wakati safu ya "SPF" inaonyesha orodha ya Exchange Online kama mtumaji wa barua pepe. Ni muhimu kutambua kuwa kazi ya uchunguzi wa sasa haipasui taarifa za "include" ndani ya rekodi za SPF, ambayo inaweza kusababisha matokeo hasi ya uwongo.

Ujumuishaji wa Mtumiaji

Niwezekana kuangalia ikiwa jina la mtumiaji lipo ndani ya mpangaji. Hii ni pamoja na watumiaji wa mwaliko, ambao majina yao ya mtumiaji yana muundo:

<email>#EXT#@<tenant name>.onmicrosoft.com

Email ni anwani ya barua pepe ya mtumiaji ambapo katika “@” imebadilishwa na mstari wa chini “_“.

Kwa AADInternals, unaweza kwa urahisi kuthibitisha ikiwa mtumiaji yupo au la:

# Check does the user exist
Invoke-AADIntUserEnumerationAsOutsider -UserName "[e-mail]"

Enumerating Unauthenticated

Enumerating Azure AD Tenant

1. Enumerating Azure AD Tenant Name: Visit the Azure portal login page and view the page source to find the Azure AD tenant name.

2. Enumerating Azure AD Tenant Users: Use the Microsoft Graph API to enumerate users in the Azure AD tenant.

3. Enumerating Azure AD Tenant Domains: Use the Microsoft Graph API to enumerate domains in the Azure AD tenant.

Initial Entry

1. Phishing Attacks: Send phishing emails to Azure AD users to obtain their credentials.

2. Brute Force Attacks: Perform brute force attacks against the Azure AD login page to guess user passwords.

3. Password Spraying: Use password spraying attacks to attempt login with commonly used passwords across multiple Azure AD accounts.

4. Credential Stuffing: Use credential stuffing attacks with leaked credentials to gain unauthorized access to Azure AD accounts.

UserName         Exists
--------         ------
[e-mail] True

Unaweza pia kutumia faili ya maandishi inayohifadhi anwani moja ya barua pepe kwa kila safu:

[e-mail]
[e-mail]
[e-mail]
[e-mail]
external.user_gmail.com#EXT#@company.onmicrosoft.com
external.user_outlook.com#EXT#@company.onmicrosoft.com

# Invoke user enumeration
Get-Content .\users.txt | Invoke-AADIntUserEnumerationAsOutsider -Method Normal

Kuna njia tatu tofauti za uchambuzi za kuchagua kutoka:

Njia	Maelezo
Kawaida	Hii inahusu API ya GetCredentialType iliyotajwa hapo juu. Njia ya msingi.
Ingia	Njia hii inajaribu kuingia kama mtumiaji. Angalizo: maswali yataorodheshwa kwenye logi za kuingia.
Autologon	Njia hii inajaribu kuingia kama mtumiaji kupitia kipengele cha autologon. Maswali hayo hayajiorodheshi kwenye logi za kuingia! Kwa hivyo, inafanya kazi vizuri pia kwa mashambulizi ya kunyunyizia nywila na nguvu ya nguvu.

Baada ya kugundua majina halali ya watumiaji unaweza kupata taarifa kuhusu mtumiaji na:

Get-AADIntLoginInformation -UserName [e-mail]

Skripti o365creeper pia inakuruhusu kugundua ikiwa barua pepe ni halali.

# Put in emails.txt emails such as:
# - [e-mail]
python.exe .\o365creeper\o365creeper.py -f .\emails.txt -o validemails.txt

Uchambuzi wa Watumiaji kupitia Microsoft Teams

Chanzo kingine kizuri cha habari ni Microsoft Teams.

API ya Microsoft Teams inaruhusu kutafuta watumiaji. Hasa "user search" endpoints externalsearchv3 na searchUsers inaweza kutumika kuomba habari za jumla kuhusu akaunti za watumiaji waliojiandikisha kwenye Teams.

Kulingana na majibu ya API, inawezekana kutofautisha kati ya watumiaji wasio wapo na watumiaji waliopo ambao wana usajili halali wa Teams.

Skripti TeamsEnum inaweza kutumika kuthibitisha seti iliyopewa ya majina ya mtumiaji dhidi ya API ya Teams.

python3 TeamsEnum.py -a password -u <username> -f inputlist.txt -o teamsenum-output.json

Enumerating Unauthenticated

Enumerating Azure AD Users

Azure AD exposes a user enumeration vulnerability that allows an attacker to discover valid usernames. By sending a request to the /common/users endpoint, an attacker can determine if a specific username exists in the Azure AD tenant. This can be achieved without authentication.

To enumerate Azure AD users:

1. Send a GET request to the /common/users endpoint.

2. Analyze the response to determine if the username exists in the Azure AD tenant.

Enumerating Azure Storage Accounts

Azure Storage Accounts can also be enumerated without authentication. By sending a request to the /subscriptions/{subscriptionId}/providers/Microsoft.Storage/storageAccounts endpoint, an attacker can discover existing storage accounts within the subscription.

To enumerate Azure Storage Accounts:

1. Send a GET request to the /subscriptions/{subscriptionId}/providers/Microsoft.Storage/storageAccounts endpoint.

2. Analyze the response to identify existing storage accounts.

Enumerating Azure Resources

Azure resources such as virtual machines, databases, and more can be enumerated without authentication. By sending requests to various Azure endpoints, an attacker can gather information about the resources present in the Azure environment.

To enumerate Azure resources:

1. Identify the endpoints corresponding to the resources of interest.

2. Send appropriate requests to these endpoints to gather information about the resources.

By enumerating unauthenticated endpoints in Azure, an attacker can gather valuable information that can be used for further exploitation and attacks.

[-] user1@domain - Target user not found. Either the user does not exist, is not Teams-enrolled or is configured to not appear in search results (personal accounts only)
[+] user2@domain - User2 | Company (Away, Mobile)
[+] user3@domain - User3 | Company (Available, Desktop)

Zaidi ya hayo, niwezekanavyo kutambua habari ya upatikanaji kuhusu watumiaji waliopo kama ifuatavyo:

• Inapatikana

• Mbali

• Usijaribu Kusumbua

• Mzibuo

• Nje ya mtandao

Ikiwa ujumbe wa nje ya ofisi umewekwa, pia niwezekanavyo kupata ujumbe huo kwa kutumia TeamsEnum. Ikiwa faili ya matokeo ilitajwa, ujumbe wa nje ya ofisi utahifadhiwa moja kwa moja ndani ya faili ya JSON:

jq . teamsenum-output.json

Enumerating Unauthenticated

Enumerating Azure AD Tenant

1. Enumerating Azure AD Tenant Name: To find the Azure AD tenant name, you can use the following URL: https://login.microsoftonline.com/<TENANT_ID>/.well-known/openid-configuration. The tenant name will be present in the response.

2. Enumerating Azure AD Users: You can use the Microsoft Graph API to enumerate Azure AD users. An example request to list users: GET https://graph.microsoft.com/v1.0/users.

3. Enumerating Azure AD Groups: Similarly, you can use the Microsoft Graph API to enumerate Azure AD groups. An example request to list groups: GET https://graph.microsoft.com/v1.0/groups.

Enumerating Azure Storage Accounts

1. Enumerating Storage Accounts: To enumerate Azure Storage Accounts, you can use the Azure CLI command: az storage account list.

2. Enumerating Blob Containers: To list the Blob Containers within a Storage Account, you can use the Azure CLI command: az storage container list --account-name <STORAGE_ACCOUNT_NAME>.

3. Enumerating File Shares: To list the File Shares within a Storage Account, you can use the Azure CLI command: az storage share list --account-name <STORAGE_ACCOUNT_NAME>.

{
"email": "user2@domain",
"exists": true,
"info": [
{
"tenantId": "[REDACTED]",
"isShortProfile": false,
"accountEnabled": true,
"featureSettings": {
"coExistenceMode": "TeamsOnly"
},
"userPrincipalName": "user2@domain",
"givenName": "user2@domain",
"surname": "",
"email": "user2@domain",
"tenantName": "Company",
"displayName": "User2",
"type": "Federated",
"mri": "8:orgid:[REDACTED]",
"objectId": "[REDACTED]"
}
],
"presence": [
{
"mri": "8:orgid:[REDACTED]",
"presence": {
"sourceNetwork": "Federated",
"calendarData": {
"outOfOfficeNote": {
"message": "Dear sender. I am out of the office until March 23rd with limited access to my email. I will respond after my return.Kind regards, User2",
"publishTime": "2023-03-15T21:44:42.0649385Z",
"expiry": "2023-04-05T14:00:00Z"
},
"isOutOfOffice": true
},
"capabilities": [
"Audio",
"Video"
],
"availability": "Away",
"activity": "Away",
"deviceType": "Mobile"
},
"etagMatch": false,
"etag": "[REDACTED]",
"status": 20000
}
]
}

Huduma za Azure

Tukijua domaini ambazo mpangaji wa Azure anatumia ni wakati wa kujaribu kupata huduma za Azure zilizofichuliwa.

Unaweza kutumia njia kutoka MicroBust kwa lengo kama hilo. Kazi hii itatafuta jina la msingi la domaini (na mabadiliko machache) katika domaini za huduma za Azure:

Import-Module .\MicroBurst\MicroBurst.psm1 -Verbose
Invoke-EnumerateAzureSubDomains -Base corp -Verbose

Uhifadhi Uliofunguliwa

Unaweza kugundua uhifadhi uliofunguliwa kwa kutumia chombo kama InvokeEnumerateAzureBlobs.ps1 ambacho kitatumia faili Microburst/Misc/permitations.txt kuunda mabadiliko (rahisi sana) kujaribu kupata akaunti za uhifadhi zilizofunguliwa.

Import-Module .\MicroBurst\MicroBurst.psm1
Invoke-EnumerateAzureBlobs -Base corp
[...]
https://corpcommon.blob.core.windows.net/secrets?restype=container&comp=list
[...]

# Access https://corpcommon.blob.core.windows.net/secrets?restype=container&comp=list
# Check: <Name>ssh_info.json</Name>
# Access then https://corpcommon.blob.core.windows.net/secrets/ssh_info.json

SAS URLs

Shared access signature (SAS) URL ni URL inayotoa ufikiaji kwa sehemu fulani ya akaunti ya Uhifadhi (inaweza kuwa kontena kamili, faili...) na idhini maalum (soma, andika...) juu ya rasilimali. Ikiwa unapata moja iliyovuja unaweza kupata ufikiaji wa habari nyeti, zinaonekana kama hivi (hii ni kufikia kontena, ikiwa ilikuwa tu kutoa ufikiaji kwa faili njia ya URL pia itaambatisha faili hiyo):

https://<storage_account_name>.blob.core.windows.net/newcontainer?sp=r&st=2021-09-26T18:15:21Z&se=2021-10-27T02:14:21Z&spr=https&sv=2021-07-08&sr=c&sig=7S%2BZySOgy4aA3Dk0V1cJyTSIf1cW%2Fu3WFkhHV32%2B4PE%3D

Tumia Storage Explorer kupata data

Compromise Credentials

Phishing

• Common Phishing (idhini au OAuth App -Illicit Consent Grant Attack-)

• Device Code Authentication Phishing

Password Spraying / Brute-Force

pageAz - Password Spraying

References

• https://aadinternals.com/post/just-looking/

• https://www.securesystems.de/blog/a-fresh-look-at-user-enumeration-in-microsoft-teams/

Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na htARTE (HackTricks AWS Red Team Expert)!

Njia nyingine za kusaidia HackTricks:

• Ikiwa unataka kuona kampuni yako ikitangazwa kwenye HackTricks au kupakua HackTricks kwa PDF Angalia MIPANGO YA KUJIUNGA!

• Pata swag rasmi wa PEASS & HackTricks

• Gundua Familia ya PEASS, mkusanyiko wetu wa NFTs ya kipekee

• Jiunge na 💬 Kikundi cha Discord au kikundi cha telegram au tufuate kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud github repos.