Azure
Getting Access
The first part of Azure pentesting is trying to get access.
This can be done via various methods
Brute forcing accounts
Phishing for tokens
Connecting to public resources that may contain credentials
Brute Forcing
We can use MSOL-Spray to spray a password for different accounts
Phishing Links
There are two ways to phish for tokens
Token Tactics
Illicit Consent Attacks
Token Tactics
We can use Token Tactics to generate a phishing link to send to the user
Now we send the email to the target
When victim clicks and enters the code, we will get his access token
Illicit Consent Attacks
This method of attack assumes you have already breached the portal, and we can further elevate our privileges by creating an application with excessive RW permissions, and trick a user to consenting the application to access data on their behalf.
There are some pre-requisites to this
In the portal, it should say that users can register applications
In User Consent Settings for Enterprise Applications, it should be configured such that users can allow consent for apps
Now we can create an application, and grant it excessive delegated permissions such as reading all data, users and files.
We then need to configure 365-Stealer
Enter the Application ID, Application Secret and Return URL
Now we run the server, and when the user clicks consent to the application, we can get their token with all the delegated permissions we obtained earlier
A note about tokens
I've written a short blog post here to describe the tokens and their related permissions
Enumeration using Tokens
Once we have access and we have the tokens of the users, we can start enumerating to see what other resources we can access
We can do this via accessing Emails or SharePoint resources
Email dumping
We use Token Tactics again to dump emails using the access token
SharePoint dumping
Listing files in SharePoint
If we see a resource with download links at @microsoft.graph.downloadUrl, we can visit the URL to download the file
Enumeration using Credentials
If we have user credentials obtained from Brute Forcing, Dumping emails and SharePoint enumeration, we can do deeper enumeration of the Azure Environment
We can either use Azure CLI, or Azure PowerShell cmdlets
The functionalities between these two approaches are similar, with each tool having slightly unique capabilites
Logging In
Logging in with normal user credentials
Logging in with SPN accounts
In order to authenticate with SPN, we need the following:
Client ID
Client Secret
Tenant ID
Client ID and Secret should be obtained via other forms of resource enumeration.
We can get Tenant ID by visiting https://login.microsoftonline.com/<DOMAIN>/.well-known/openid-configuration
For example
Now we can login
Enumerating Resources
In the event where you see a container, but the resources are not being shown due to permission issues, we can download them to our local machine instead
Or, we can use Storage Explorer.exe to connect to subscriptions or publicly accessible storage containers
Listing Roles
We need to look out for custom roles, which are user created non-standard roles which contain special privileges
Listing Users
Listing all users in the Azure AD
Listing Groups
Getting groups on the AD, as well as group memberships
Listing Roles in Azure AD
For this, we need to run Connect-AzureAD with the credentials
Then we list available roles
And list members who have the role
If we have a role that can reset passwords, we can do so with these commands
Access Password Vaults
After listing resources, if we see password vaults, we can access the plain text passwords stored in them.
Vaults require special types of tokens to access. These tokens can be obtained with Azure CLI
Once we have the token, we use Azure PowerShell cmdlet to access the data
Requesting for Tokens
After we have authenticated as a user on Azure CLI, we can request for more token to access other services such as GraphAPI or Azure Password vaults
Last updated