BSides Portland - Attacking Azure Environments with PowerShell
0 likes643 views
The document discusses techniques for extracting data from Azure environments using PowerShell, highlighting the importance of Azure management security. It outlines various Azure services, tools like Microburst, and demonstrates methods for unauthorized access and escalation. Recommendations for securing Azure accounts include limiting management access, addressing misconfigurations, and implementing multi-factor authentication.
BSides Portland - Attacking Azure Environments with PowerShell
- 1. ATTACKING AZURE ENVIRONMENTS WITH POWERSHELL KARL FOSAAEN
- 2. 2 Confidential & Proprietary WHO AM I Karl Fosaaen Pen Tester Password Cracker Social Engineer Blogger Cloud Enthusiast Homebrewer https://github.com/netspi https://blog.netspi.com/ Twitter - @kfosaaen
- 3. 3 Confidential & Proprietary TALK OVERVIEW Outline Intro to Dumping Azure Data − Why/How Azure Services Covered − AzureAD Users and Groups − Storage Accounts − AzureSQL − Passwords Demos/Questions − Sample Escalation Process
- 4. 4 Confidential & Proprietary4 Confidential & Proprietary DUMPING AZURE DATA
- 5. 5 Confidential & Proprietary DUMPING AZURE DATA Why do we want to dump data from Azure? We frequently get Azure creds during assessments − Integrated AD (DCSync) + Fall2018 = Azure Access Regular domain users can usually list info about Azure − Not regularly locked down Azure infrastructure audits Why can we do this? Azure management is available over the internet Frequently without MFA Why do we want to automate this? Doing a million PS commands by hand is annoying
- 6. 6 Confidential & Proprietary DUMPING AZURE DATA MicroBurst GitHub Link - https://github.com/NetSPI/MicroBurst Current Functions: ▪ Invoke-EnumerateAzureBlobs ▪ Invoke-EnumerateAzureSubDomains ▪ Get-AzurePasswords ▪ Get-AzureDomainInfo ▪ Get-MSOLDomainInfo Module Dependencies: − Azure − AzureRM − MSOnline
- 7. 7 Confidential & Proprietary AZURE PERMISSIONS Permissions Three Important Levels − Owner − Contributor − Reader Additional Roles − Different Administrative/Reader Roles − Not hugely important here
- 8. 8 Confidential & Proprietary DUMPING AZURE DATA Ways to dump data from Azure Azure Portal − Pros – Graphical interface, easy to look at for review − Cons – Not great at scale REST APIs − Pros – Structured, JSON return data − Cons – Authentication pain points, JSON data formatting PowerShell Cmdlets − Pros − Integrated Auth − Data returned as pipeline-able objects − Easier output − Can handle data at scale − Cons − Limited threading options
- 9. 9 Confidential & Proprietary DUMPING AZURE DATA PowerShell Cmdlet Modules Azure Service Management (ASM) − Older style of Azure Administration AzureRM − Newer option for Resource Management AZ − Latest option, currently in preview − Will eventually replace AzureRM MSOnline − Office 365 Administration − When you don’t have rights to run the others
- 10. 10 Confidential & Proprietary DUMPING AZURE DATA Existing Tools − Azucar - https://github.com/nccgroup/azucar/ − Didn’t quite fit my use cases − Didn’t work well with several of the environments I tried − AzuriteExplorer - https://github.com/mwrlabs/Azurite − Similar functionality − Doesn’t appear to be actively maintained (broken AzureRM cmdlets)
- 11. 11 Confidential & Proprietary DUMPING AZURE DATA Required Reading Pentesting Azure Applications - Matt Burrough − https://nostarch.com/azure Clearly outlines testing process Explains why you should be doing this Good example scripts
- 12. 12 Confidential & Proprietary12 Confidential & Proprietary AZURE SERVICES
- 13. 13 Confidential & Proprietary AZURE SERVICES Here are some of the services that we’ll cover in this talk MicroBurst dumps more data than this, but we don’t have time to cover everything − Authenticated − AzureAD Users and Groups − Storage Accounts − App Services − AzureSQL − NSG/Firewall Rules − RBAC Roles − Passwords − Unauthenticated − Azure Blob Storage Enumeration − General Azure Services Enumeration
- 14. 14 Confidential & Proprietary AZURE SERVICES AzureAD Users and Groups − Additional Recon Info − Phone Numbers − Enrolled Devices − Third Party Apps (SSO Integration) − Guest Users Practical Examples − Password Guessing Attacks − Phishing − Accessing third party apps (AWS, WebEx, HR/Expense systems) − Office365
- 15. 15 Confidential & Proprietary AZURE SERVICES Storage Accounts Naming Structure - netspiazure.*Service*.core.windows.net Data Types − Blobs (blob) − File Services (file) − Data Tables (table) − Queues (queue)
- 16. 16 Confidential & Proprietary AZURE SERVICES Anonymous Blob Enumeration Enumerate Storage Accounts − DNS lookups on keywords − Bing Searches to expand the scope Enumerate Public Folders − Azure REST APIs Practical Examples − Config files − VHD files − PII/Passwords − Hosting Payloads Blog Post - https://blog.netspi.com/anonymously-enumerating-azure-file-resources/
- 17. 17 Confidential & Proprietary AZURE SERVICES Azure SQL Microsoft SQL – In the Cloud Data Access − Firewall rules requirements − SQL Management Studio − Direct Portal Access Azure SQL as a C2 -------------→ Practical Examples − Dev ENV − Open FW rules − Weak SA Password
- 18. 18 Confidential & Proprietary AZURE SERVICES Passwords Key Vaults − Keys − Certs − Passwords App Services Configurations − Deployment Credentials − Database Connection Strings Automation Accounts − Credentials for Azure Automation accounts Blog Post - https://blog.netspi.com/get-azurepasswords/
- 19. 19 Confidential & Proprietary AZURE SERVICES Passwords Automation Accounts − Credentials for Azure Automation accounts − Process: − Create Automation Script − Import Automation Script − Run Automation Script − Get Automation Script Output − Delete Automation Script Blog Post - https://blog.netspi.com/get-azurepasswords/
- 20. 20 Confidential & Proprietary MICROBURST USAGE MicroBurst How to Run the Tools − Import the Module − Import-Module C:MicroBurstMicroBurst.psm1 -Verbose CMD Examples − Invoke-EnumerateAzureBlobs -Base microburst − Invoke-EnumerateAzureSubDomains -Base microburst –Verbose − Get-AzurePasswords -Verbose | Out-GridView − Get-AzureDomainInfo –folder MicroBurst –Verbose − Get-MSOLDomainInfo –folder MicroBurst –Verbose
- 21. 21 Confidential & Proprietary21 Confidential & Proprietary DEMO
- 22. 22 Confidential & Proprietary DEMO Sample Escalation Anonymously enumerate a public blob storage container (Invoke-EnumerateAzureBlobs) − List files − Download VHD − Parse credentials from VHD file − Crack hashes for Local Creds and Cached Creds − Run VHD locally − Login to VM (via RDP) − Login to Azure with the cracked domain creds Connect as domain user and dump domain info (Get-AzureDomainInfo) − List out users/services/etc. Dump remaining domain passwords for Azure subscription (Get-AzurePasswords) − Get VPN access, pivot to internal domain/network Execute Commands on all Azure VMs (as nt authoritySYSTEM)
- 23. 23 Confidential & Proprietary
- 24. 24 Confidential & Proprietary
- 25. 25 Confidential & Proprietary CRACKING LOCAL ADMIN
- 26. 26 Confidential & Proprietary LOCAL ADMIN -> LOAD VHD IN HYPER-V
- 27. 27 Confidential & Proprietary LOCAL ADMIN -> RDP -> MIMIKATZ *Ideal Situation ktest also happens to be a DA RDP is open to everywhere
- 28. 28 Confidential & Proprietary GRABBING CACHED CREDENTIALS *Slightly more realistic situation RDP is not open But the system is domain joined
- 29. 29 Confidential & Proprietary CRACKING CACHED CREDENTIALS *Slightly more realistic situation RDP is not open But the system is domain joined
- 30. 30 Confidential & Proprietary
- 31. 31 Confidential & Proprietary
- 32. 32 Confidential & Proprietary DEMO - CODE EXECUTION Execute Commands on all Azure VMs (as nt authoritySYSTEM) − Invoke-AzureRmVMRunCommand − Requires “Contributor” rights Practical Uses − Mimikatz everything − Task C2 agents − Search for data Not Practical Uses − Botnets − Crypto miners − Delete everything Mileage may vary depending on VM/Region
- 33. 33 Confidential & Proprietary DEMO - CODE EXECUTION
- 34. 34 Confidential & Proprietary34 Confidential & Proprietary FIXES/CONCLUSIONS
- 35. 35 Confidential & Proprietary FIXES / CONCLUSIONS Fixes Limit Azure Management access for non-admin users Watch out for misconfigurations in your Azure environment Try to get users to stop using Fall2018 as a password Set up MFA for all users with Azure access Conclusions The cloud is complicated, misconfigurations will happen But there are options for mitigating the risks
- 36. 36 Confidential & Proprietary36 Confidential & Proprietary QUESTIONS
- 37. 37 Confidential & Proprietary Thanks! NetSPI co-workers for the QA/Testing/Ideas All of you who came to a Saturday afternoon talk And all of you watching this on YouTube
- 38. 38 Confidential & Proprietary ADDITIONAL INFO MicroBurst GitHub - https://github.com/NetSPI/MicroBurst NetSPI Blog - https://blog.netspi.com MicroBurst Specific Blogs: https://blog.netspi.com/get-azurepasswords/ https://blog.netspi.com/anonymously-enumerating-azure-file-resources/ https://blog.netspi.com/enumerating-azure-services/ Twitter - @kfosaaen SlideShare - http://www.slideshare.net/kfosaaen
- 39. MINNEAPOLIS | NEW YORK | PORTLAND | DENVER | DALLAS https://www.netspi.com https://www.facebook.com/netspi @NetSPI https://www.slideshare.net/NetSPI