Azure Exploit

Azure Exploit#

Offensive tradecraft for Azure. Local artifacts give the operator foothold material; MicroBurst harvests credentials across Key Vaults, App Services, Automation, and Storage; PowerZure provides full assessment functions broken out by Azure role.

Azure local artifacts#

Azure file or folder created locally.

# TokenCache.dat is cleartext containing the AccessKey;
# inject into user's process to view contents of file
C:\Users\<USERNAME>\.Azure\TokenCache.dat

PowerShell Azure modules installed.

# locations indicating installed Azure modules
C:\Program Files\windowsPowerShell\Modules\Az.*
C:\Users\<USERNAME>\Documents\WindowsPowerShell\Modules\Az.*
C:\Windows\system32\windowsPowerShell\v1.0\Modules\Az.*

Search for Save-AzContext usage and file location.

PS> Get-PSReadLineOption
PS> Select-String -Path <\path\to\ConsoleHost_history.txt> -Pattern 'Save-AzContext'

Azure token cached data, key inside TokenCache: JSON file is base64-encoded data. Decode it to recreate TokenCache.dat.

Import decoded TokenCache.dat into attacker local PowerShell. Once imported the attacker will not be prompted for user / password.

PS> Import-AzContext -Path C:\path\to\decoded_TokenCache.dat

MicroBurst#

Scenario, you have been able to obtain credentials for a privileged user for Azure AD (Owner or Contributor). Target this user by harvesting credentials stored in Key Vaults, App Services Configurations, Automation Accounts, and Storage Accounts.

Step 1, install PowerShell modules and import MicroBurst (NetSPI).

Install-Module -Name AzureRM
Install-Module -Name Azure

# https://github.com/NetSPI/MicroBurst
Import-Module .\Get-AzurePasswords.ps1

Step 2, retrieve all available credentials at once.

Get-AzurePasswords -Verbose | Export-CSV

PowerZure#

PowerZure is a PowerShell script for assessing Azure security. Functions are grouped by their context and the role needed to run them.

Help.

Function	Description	Role
`PowerZure -h`	Help menu	Any

Mandatory.

Function	Description	Role
`Set-Subscription`	Set the default subscription	Reader

Operational.

Function	Description	Role
`Create-Backdoor`	Create a Runbook that creates an Azure account and a webhook	Admin
`Execute-Backdoor`	Execute the backdoor; needs URI from Create-Backdoor	Admin
`Execute-Command`	Execute a command on a specified VM	Contributor
`Execute-MSBuild`	Execute MSBuild payload on a specified VM (runs as SYSTEM)	Contributor
`Execute-Program`	Execute a supplied program	Contributor
`Upload-StorageContent`	Upload a file to a storage share	Contributor
`Stop-VM` / `Start-VM` / `Restart-VM`	Stop, start, restart a VM	Contributor
`Start-Runbook`	Start a specific Runbook	Contributor
`Set-Role`	Assign a role on a resource or subscription	Owner
`Remove-Role`	Remove a user from a role	Owner
`Set-Group`	Add a user to a group	Admin

Info gather.

Function	Description	Role
`Get-CurrentUser`	Current user info (name, role, groups, owned objects)	Reader
`Get-AllUsers`	All users in the subscription	Reader
`Get-User`	Info on a specific user	Reader
`Get-AllGroups`	All groups in Azure AD	Reader
`Get-Resources`	All resources in the subscription	Reader
`Get-Apps`	All applications in the subscription	Reader
`Get-GroupMembers`	Members of a group (group does not mean role)	Reader
`Get-AllGroupMembers`	Members of all groups	Reader
`Get-AllRoleMembers`	Members of all roles	Reader
`Get-Roles`	Roles in the subscription	Reader
`Get-RoleMembers`	Members of a role	Reader
`Get-Sps`	All service principals	Reader
`Get-Sp`	Info on a specified service principal	Reader
`Get-AppPermissions`	Permissions of an app	Reader
`Get-WebApps`	Running web apps	Reader
`Get-WebAppDetails`	Running web apps details	Reader

Secret gather.

Function	Description	Role
`Get-KeyVaults`	List Key Vaults	Reader
`Get-KeyVaultContents`	Secrets from a specific Key Vault	Contributor
`Get-AllKeyVaultContents`	Secrets from all Key Vaults	Contributor
`Get-AppSecrets`	Application passwords or cert credentials	Contributor
`Get-AllAppSecrets`	All application secrets (if accessible)	Contributor
`Get-AllSecrets`	All secrets from Key Vaults and applications	Contributor
`Get-AutomationCredentials`	Credentials from any Automation Account	Contributor

Data exfil.

Function	Description	Role
`Get-StorageAccounts`	All storage accounts	Reader
`Get-StorageAccountKeys`	Account keys for a storage account	Contributor
`Get-StorageContents`	Contents of a storage container or file share	Reader
`Get-Runbooks`	All Runbooks	Reader
`Get-RunbookContent`	Content of a specific Runbook	Reader
`Get-AvailableVMDisks`	VM disks available	Reader
`Get-VMDisk`	Generates a download link for a VM disk (valid for one hour)	Contributor
`Get-VMs`	Available VMs	Reader

Azure Exploit

Contents

Azure Exploit#

Azure local artifacts#

MicroBurst#

PowerZure#

References#