DEF CON 25 - Gerald-Steere-and-Sean-Metcalf-Hacking-the-Cloud.pdf
- 1. Hacking the Cloud Gerald Steere β Microsoft C+E Red Team (@Darkpawh) Sean Metcalf β CTO Trimarc (@pyrotek3)
- 2. Gerald Steere - @darkpawh 10+ years experience as a penetration tester and red team operatorβ Member of C+E Red Team since 2014β Speaker at BlueHat and Bsides Seattle Spends work days happily smashing atoms in Azure About Us
- 3. Sean Metcalf - @pyrotek3 Founder Trimarc, a security company. Microsoft Certified Master (MCM) Directory Services Speaker: Black Hat, BSides, DEF CON, DerbyCon, Shakacon, Sp4rkCon Security Consultant / Security Researcher Own & Operate ADSecurity.org (Microsoft platform security info) About Us +
- 4. Cloud FTW! Whatβs in it for me? Staying clean while being mean Buzzword bingo with cloud lingo Pathfinding, recon, and targeting in multiple dimension Currency exchange β what do I do with all these hashes? Happy fun exploit time (with demos) Countermeasures and proper protection Cloud? Who cares!
- 5. Whatβs in it for me?
- 6. Cloud matters for business Your client probably uses it, whether you (or they) realize it or not Many traditional techniques do not work Same concepts but new ways of thinking Whatβs in it for me?
- 7. When we last saw our intrepid red team Hired to red team SithCo Have domain admin on a subsidiary domain SithCo uses public cloud resources to host web applications Hacker Quest How do we leverage access to get into SithCo corporate?
- 8. Staying clean while being mean Cause pissing off The Net is bad for business
- 9. Can I really go after my clientβs cloud deployments? We are not lawyers. If youβre a professional you need one of those to talk to ALWAYS. Staying Clean
- 10. Lawful Evil is a perfectly valid alignment Scope & Access will be more limited Spell out enforced limitations in your reporting Cloud providers typically require an approval process be followed Staying Clean
- 11. Attacking Azure, AWS, or Google Cloud Deployments Requires preapproval by account owner (Azure and AWS) Standard Rules of Engagement (RoE) stuff Limited to customer owned resources No DoS Can include attempts to break isolation (Azure) Staying Clean
- 12. Buzzword Bingo Do you have your card ready?
- 13. Accessibility modifiers Public could Private cloud Hybrid cloud Buzzword Bingo https://www.stickermule.com/marketplace/3442-there-is-no- cloud
- 14. All the aaS Buzzword Bingo Albert Barron β https://www.linkedin.com/pulse/20140730172610-9679881-pizza-as-a-service
- 15. Itβs not domain, but itβs still admin Cloud assets are managed under an account or subscription Getting access to that layer is often equivalent to DA Buzzword Bingo
- 16. CloudOS - Same ideas, different words Buzzword Bingo Server Domain Domain Admin Pass the Hash Private IPs RDP / SSH Services Subscription Subscription Admin Credential Pivot Public IPs Management APIs Faust and Johnson β Cloud Post Exploitation Techniques Infiltrate 2017 https://vimeo.com/214855977
- 17. Whereβs the data? Cloud services rely on data storage for nearly everything How is data stored in the cloud? Do I need to attack the service or is the data my real goal? Buzzword Bingo Image: Β©MITRE
- 19. Pathfinding, recon, and targeting in multiple dimension How do I figure out I even need to look at the cloud?
- 20. Identifying Cloud Deployments In the public cloud β DNS is your best friend Pathfinding
- 21. Cloud Recon: DNS MX Records β’ Microsoft Office 365: DOMAIN-COM.mail.protection.outlook.com β’ Google Apps (G Suite): *.google OR *.googlemail.com β’ Proofpoint (pphosted) β’ Cisco Email Security (iphmx) β’ Cyren (ctmail) β’ GoDaddy (secureserver) β’ CSC (cscdns) Pathfinding
- 22. Cloud Recon: DNS TXT Records MS = Microsoft Office 365 Google-Site-Verification = G Suite Amazonses = Amazon Simple Email OSIAGENTREGURL = Symantec MDM AzureWebsites = Microsoft Azure Paychex = Paychex financial services Docusign = Docusign digital signatures Atlassian-* = Atlassian services Pathfinding
- 23. Cloud Recon: SPF Records SalesForce (salesforce.com, pardot.com, & exacttarget.com) MailChimp (mcsv.net) Mandrill (MailChimp paid app) Q4Press (document collaboration) Zendesk (support ticket) Oracle Marketing (Eloqua.com) Constant Contact (email marketing) Postmark (mtasv.net) Pathfinding
- 24. Discover Federation Servers No standard naming for FS. DNS query for: β’ adfs β’ auth β’ fs β’ okta β’ ping β’ sso Pathfinding
- 25. Federation Web Page Detail Pathfinding
- 26. OWA Version Discovery Check for autodiscover subdomain (autodiscover.domain.com) Connect to autodiscover web page (https://autodiscover.domain.com) Copyright date effectively provides Exchange version: 2006 = Microsoft Exchange 2007 Pathfinding
- 27. Cloud and Federation Attackers go after Identity since that provides access to resources.
- 28. Modern auth Cloud authentication and authorization is typically independent from the on-premises domain, though Federation may provide a path⦠How you authenticate will depend on the specific cloud provider More Buzzword Bingo: ⒠OAUTH ⒠OpenID ⒠SAML ⒠WS-Federation ⒠WS-Trust Identity
- 29. Identity
- 30. ADFS Federation Server Config Identity Federation server typically lives on the internal network with a proxy server in the DMZ. Certificates installed on Federation server Service communication Token-decrypting Token-signing Relying party trusts: cloud services and applications Claim rules: determine what type of access and from where access is allowed.
- 31. Federation Key Points Identity Federation: trust between organizations leveraging PKI (certificates matter) Cloud SSO often leverages temporary or persistent browser cookies (cookies provide access) Several protocols may be supported, though typically SAML. (protocols and versions matter) Federation server (or proxy) is on public internet via port 443 (HTTPS).
- 32. How to steal identities β federated style Identity Federation is effectively Cloud Kerberos. Own the Federation server, own organizational cloud services. Token & Signing certificates ~= KRBTGT (think Golden Tickets) Steal federation certificates to spoof access tokens (Mimikatz fun later).
- 33. On-Premises Cloud Components How do we get those identities into the cloud anyways?
- 34. Active Directory & the Cloud Identity Active Directory provides Single Sign On (SSO) to cloud services. Some directory sync tools synchronizes all users and their attributes to cloud service(s). Most sync engines only require AD user rights to send user and group information to cloud service. Most organizations arenβt aware of all cloud services active in their environment.
- 35. Express Permissions for Azure AD Connect Identity https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-accounts-permissions
- 36. Custom Permissions for Azure AD Connect Identity https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-accounts-permissions
- 37. Currency exchange β what do I do with all these hashes? I never liked buying tokens, but thatβs all these things take
- 38. Spending our horde Iβve got all these hashes and no where to go No matter how many times youβve popped the KRBTGT account, your cloud provider really doesnβt care Currency exchange
- 39. Creds, creds never change Certificates, certificates, certificates! Popping dev boxes has never been more productive You do know mimikatz can also export certificates, right? Currency exchange
- 40. What is old is new again Password Spraying involves attempting authentication with a single password against all users before moving on to the next password. Works against Cloud services: email, IM, etc. Low & Slow: 1 to 2 per hour Often works against VPN as well. Currency exchange
- 41. Password spraying tools OWA-Toolkit: https://github.com/johnnyDEP/OWA-Toolkit MailSniper: Invoke-PasswordSprayOWA https://github.com/dafthack/MailSniper Patator: https://github.com/lanjelot/patator LyncSniper: https://github.com/mdsecresearch/LyncSniper https://www.mdsec.co.uk/2017/04/penetration-testing-skype-for- business-exploiting-the-missing-lync/ The authors have not evaluated these tools. Always test before use. Currency exchange
- 42. DevOops DevOps probably has what you are looking for API keys and shared secrets for the win Source code access for fun and profit How are these deployments done anyways? Currency exchange
- 43. Where Are API Keys? GitHub! Currency exchange https://hackernoon.com/how-to-use-environment-variables- keep-your-secret-keys-safe-secure-8b1a7877d69c https://github.com/jjenkins/node-amazon-ses/issues/9
- 44. The circle of access Access between on-premises and cloud deployments often a two way street On-premises -> cloud typically involves identifying credentials Is there a way back? Are there shared authentication methods? Currency exchange
- 45. The circle of access What is the likelihood this cloud service needs to access resources from on- premises? Currency exchange
- 46. Happy fun exploit time Pray to the demo gods, pray I say!
- 47. Demo stuff here Currency exchange There should be a fun live demo here if everything goes right
- 48. Countermeasures and proper protection Closing my eyes and hoping it goes away isnβt going to work, is it?
- 49. Giving useful advice Telling your client to close up shop and moving back into the basement is probably a non-starter Clouds do provide real business benefits and can improve security when done right How can the βcloudβ be secured? Countermeasures
- 50. Giving useful advice: The Basics Properly handle, store, and mange credentials and secrets You arenβt storing those access keys in GIT are you? Clouds do provide managed secret stores Make it easy for DevOps to do the right thing Enforce MFA on all accounts If it canβt have MFA, limit it as much as possible and monitor it Countermeasures
- 51. Giving useful advice: Securing Federation Protect Federation servers at the same level as Domain Controllers. Use a proxy server to limit communication directly with federation server inside the network. Audit cloud authentication by logging Federation auth events & send to SIEM. Enable multifactor authentication for all admin accounts & preferably all cloud accounts. Control Cloud authentication via Federation rules. Example: Internal network access provides single sign-on External access requires username, password, and two-factor authentication Countermeasures
- 52. Giving useful advice Many of the basics remain the same Least privilege is key and poorly understood in many cloud implementations Least access, use the security features provided by the cloud Credential management is hard in a connected world β this is an massive opportunity for attackers Countermeasures
- 53. Monitoring and alerting Itβs not just for your network any more Defenders need to work with DevOps to make sure that cloud resources and data are considered in defensive designs Different cloud providers provide different tools for managing security Defenders must be familiar with the tools from cloud providers used by their client Log collection and management needs to include cloud assets You do know what your assets are, right? Assume breach! Countermeasures
- 54. Conclusion Are we there yet?
- 55. References Infiltrate 2017: Cloud Post Exploitation Techniques - Andrew Johnson & Sacha Faust https://vimeo.com/214855977 Azure Security: https://portal.msrc.microsoft.com/en- us/engage/pentest AWS Security: https://aws.amazon.com/security/penetration-testing/ Google Cloud Security: https://cloud.google.com/security/ MailSniper: https://github.com/dafthack/MailSniper Patator: https://github.com/lanjelot/patator Conclusion