Ili kukagua mazingira ya AZURE ni muhimu sana kujua: ni huduma zipi zinatumika, nini kinachoweza kuonyeshwa, nani ana ufikiaji wa nini, na jinsi huduma za ndani za Azure na huduma za nje zinavyounganishwa.
Kutoka kwa mtazamo wa Red Team, hatua ya kwanza ya kuathiri mazingira ya Azure ni kupata akili za Azure AD. Hapa kuna mawazo kadhaa juu ya jinsi ya kufanya hivyo:
Faili accessTokens.json katika az cli kabla ya 2.30 - Jan2022 - ilihifadhi tokens za ufikiaji kwa maandiko wazi
Faili azureProfile.json ina habari kuhusu mtumiaji aliyeingia.
az logout inafuta token.
Matoleo ya zamani ya Az PowerShell yalihifadhi tokens za ufikiaji kwa maandiko wazi katika TokenCache.dat. Pia inahifadhi ServicePrincipalSecret kwa maandiko wazi katika AzureRmContext.json. Cmdlet Save-AzContext inaweza kutumika kuhifadhi tokens.
Tumia Disconnect-AzAccount kuondoa hizo.
Hata kama huja athiri mtumiaji yeyote ndani ya tenant ya Azure unayoishambulia, unaweza kusanya habari fulani kutoka kwake:
Baada ya kufanikiwa kupata akili, unahitaji kujua ni nani akili hizo zinamilikiwa, na nini wana ufikiaji, hivyo unahitaji kufanya uainishaji wa msingi:
Uainishaji wa Msingi
Kumbuka kwamba sehemu ya kelele zaidi ya uainishaji ni kuingia, si uainishaji wenyewe.
SSRF
Ikiwa umepata SSRF katika mashine ndani ya Azure angalia ukurasa huu kwa hila:
Kupita Masharti ya Kuingia
Katika hali ambapo una akili halali lakini huwezi kuingia, hizi ni baadhi ya ulinzi wa kawaida ambao unaweza kuwepo:
IP whitelisting -- Unahitaji kuathiri IP halali
Vikwazo vya Geo -- Pata mahali mtumiaji anaishi au ofisi za kampuni na pata IP kutoka jiji moja (au nchi angalau)
Kivinjari -- Labda kivinjari tu kutoka OS fulani (Windows, Linux, Mac, Android, iOS) kinaruhusiwa. Jua ni OS ipi mwathirika/kampuni inatumia.
Unaweza pia kujaribu kuathiri akili za Service Principal kwani kawaida huwa na mipaka kidogo na kuingia kwake hakuchunguzwi sana
Baada ya kupita, unaweza kurudi kwenye mipangilio yako ya awali na bado utakuwa na ufikiaji.
Jifunze jinsi ya kufunga az cli, AzureAD na Az PowerShell katika sehemu ya Az - AzureAD.
Moja ya mambo ya kwanza unahitaji kujua ni wewe ni nani (katika mazingira gani uko):
azaccountlistazaccounttenantlist# Current tenant infoazaccountsubscriptionlist# Current subscription infoazadsigned-in-usershow# Current signed-in userazadsigned-in-userlist-owned-objects# Get owned objects by current userazaccountmanagement-grouplist#Not allowed by default
#Get the current session stateGet-AzureADCurrentSessionInfo#Get details of the current tenantGet-AzureADTenantDetail
# Get the information about the current context (Account, Tenant, Subscription etc.)Get-AzContext# List all available contextsGet-AzContext-ListAvailable# Enumerate subscriptions accessible by the current userGet-AzSubscription#Get Resource groupGet-AzResourceGroup# Enumerate all resources visible to the current userGet-AzResource# Enumerate all Azure RBAC role assignmentsGet-AzRoleAssignment# For all usersGet-AzRoleAssignment-SignInName test@corp.onmicrosoft.com # For current user
Moja ya amri muhimu zaidi za kuhesabu Azure ni Get-AzResource kutoka Az PowerShell kwani inakuwezesha kujua rasilimali ambazo mtumiaji wako wa sasa anaweza kuona.
Kwa kawaida, mtumiaji yeyote anapaswa kuwa na idhini ya kutosha kuhesabu mambo kama vile, watumiaji, vikundi, majukumu, wahusika wa huduma... (angalia idhini za kawaida za AzureAD).
Unaweza kupata hapa mwongozo:
Sasa kwamba una taarifa fulani kuhusu akidi zako (na ikiwa wewe ni timu nyekundu matumaini huja gundulika). Ni wakati wa kubaini ni huduma zipi zinatumika katika mazingira.
Katika sehemu ifuatayo unaweza kuangalia njia kadhaa za kuhesabu huduma za kawaida.
Service Principal and Access Policy
Huduma ya Azure inaweza kuwa na Utambulisho wa Mfumo (wa huduma yenyewe) au kutumia Utambulisho wa Usimamizi uliopewa Mtumiaji. Utambulisho huu unaweza kuwa na Sera ya Ufikiaji, kwa mfano, kwa KeyVault kusoma siri. Sera hizi za Ufikiaji zinapaswa kuwa na mipaka (kanuni ya haki ndogo), lakini zinaweza kuwa na ruhusa zaidi ya inavyohitajika. Kwa kawaida, Huduma ya Programu ingetumia KeyVault kupata siri na vyeti.
Hivyo ni muhimu kuchunguza utambulisho hizi.
App Service SCM
Konsoli ya Kudu kuingia kwenye 'konteina' ya Huduma ya Programu.
Webshell
Tumia portal.azure.com na uchague shell, au tumia shell.azure.com, kwa bash au powershell. 'disk' ya shell hii inahifadhiwa kama faili ya picha katika akaunti ya hifadhi.
Azure DevOps
Azure DevOps ni tofauti na Azure. Ina hazina, mipango (yaml au toleo), bodi, wiki, na zaidi. Makundi ya Kigezo yanatumika kuhifadhi thamani za kigezo na siri.
Import-Module monkey365Get-HelpInvoke-Monkey365Get-HelpInvoke-Monkey365-DetailedInvoke-Monkey365-IncludeAzureActiveDirectory -ExportTo HTML -Verbose -Debug -InformationAction ContinueInvoke-Monkey365- Instance Azure -Analysis All -ExportTo HTML
# Start Backendcd stormspotter\backend\pipenv shellpython ssbackend.pyz# Start Front-endcd stormspotter\frontend\dist\spa\quasar.cmd serve -p 9091--history# Run Stormcollectorcd stormspotter\stormcollector\pipenv shellaz login -u test@corp.onmicrosoft.com -p Welcome2022!python stormspotter\stormcollector\sscollector.pyz cli# This will generate a .zip file to upload in the frontend (127.0.0.1:9091)
# You need to use the Az PowerShell and Azure AD modules:$passwd =ConvertTo-SecureString"Welcome2022!"-AsPlainText -Force$creds =New-Object System.Management.Automation.PSCredential ("test@corp.onmicrosoft.com", $passwd)Connect-AzAccount-Credential $credsImport-Module AzureAD\AzureAD.psd1Connect-AzureAD-Credential $creds# Launch AzureHound. AzureHound\AzureHound.ps1Invoke-AzureHound-Verbose# Simple queries## All Azure UsersMATCH (n:AZUser) return n.name## All Azure ApplicationsMATCH (n:AZApp) return n.objectid## All Azure DevicesMATCH (n:AZDevice) return n.name## All Azure GroupsMATCH (n:AZGroup) return n.name## All Azure Key VaultsMATCH (n:AZKeyVault) return n.name## All Azure Resource GroupsMATCH (n:AZResourceGroup) return n.name## All Azure Service PrincipalsMATCH (n:AZServicePrincipal) return n.objectid## All Azure Virtual MachinesMATCH (n:AZVM) return n.name## All Principals with the ‘Contributor’ roleMATCH p = (n)-[r:AZContributor]->(g) RETURN p# Advanced queries## Get Global AdminsMATCH p =(n)-[r:AZGlobalAdmin*1..]->(m) RETURN p## Owners of Azure GroupsMATCH p = (n)-[r:AZOwns]->(g:AZGroup) RETURN p## All Azure Users and their GroupsMATCH p=(m:AZUser)-[r:MemberOf]->(n) WHERE NOT m.objectid CONTAINS 'S-1-5'RETURN p## Privileged Service PrincipalsMATCH p = (g:AZServicePrincipal)-[r]->(n) RETURN p## Owners of Azure ApplicationsMATCH p = (n)-[r:AZOwns]->(g:AZApp) RETURN p## Paths to VMsMATCH p = (n)-[r]->(g: AZVM) RETURN p## Paths to KeyVaultMATCH p = (n)-[r]->(g:AZKeyVault) RETURN p## Paths to Azure Resource GroupMATCH p = (n)-[r]->(g:AZResourceGroup) RETURN p## On-Prem users with edges to AzureMATCH p=(m:User)-[r:AZResetPassword|AZOwns|AZUserAccessAdministrator|AZContributor|AZAddMembers|AZGlobalAdmin|AZVMContributor|AZOwnsAZAvereContributor]->(n) WHERE m.objectid CONTAINS 'S-1-5-21' RETURN p
## All Azure AD Groups that are synchronized with On-Premise ADMATCH (n:Group) WHERE n.objectid CONTAINS 'S-1-5' AND n.azsyncid IS NOT NULL RETURN n
# You should use an account with at least read-permission on the assets you want to accessgitclonehttps://github.com/nccgroup/azucar.gitPS> Get-ChildItem-Recursec:\Azucar_V10|Unblock-FilePS> .\Azucar.ps1-AuthModeUseCachedCredentials-Verbose-WriteLog-Debug-ExportToPRINTPS> .\Azucar.ps1 -ExportTo CSV,JSON,XML,EXCEL -AuthMode Certificate_Credentials -Certificate C:\AzucarTest\server.pfx -ApplicationId 00000000-0000-0000-0000-000000000000 -TenantID 00000000-0000-0000-0000-000000000000
PS> .\Azucar.ps1 -ExportTo CSV,JSON,XML,EXCEL -AuthMode Certificate_Credentials -Certificate C:\AzucarTest\server.pfx -CertFilePassword MySuperP@ssw0rd! -ApplicationId 00000000-0000-0000-0000-000000000000 -TenantID 00000000-0000-0000-0000-000000000000
# resolve the TenantID for an specific usernamePS> .\Azucar.ps1-ResolveTenantUserNameuser@company.com