2 of 25

D: \nullhyderabad> type whoami

Syed Izhar Ahmed

Cloud Security Engineer @ Brio Technologies

Founder @ InfosecIITG

Certifications

AZ500 Azure Security Engineer
SC100 Cybersecurity Architect Expert

Linkedin : https://www.linkedin.com/in/izharahmedsyed/

3 of 25

D: \ nullhyderabad> Scenario

Our team, renowned for its expertise in cybersecurity, has been approached by Mega Big Tech, a leading tech giant, to conduct a comprehensive penetration test on their infrastructure.

The only information given to us is the domain name, �which is megabigtech.com�

4 of 25

D: \ nullhyderabad> Agenda

Initial Recon
Expanding Attack Surface
Lateral Movement & Exploitation

5 of 25

Initial Recon

6 of 25

D:\ Initial Recon> Information_Disclosure

During our OSINT analysis, we spotted a potential leak on Pastebin that could prove valuable for future use.

7 of 25

�D:\ Initial Recon> Entra_ID_Presence

You can verify if a company is using Entra ID for authentication by visiting the following URL:

https://login.microsoftonline.com/getuserrealm.srf?login=<COMPANYNAME>&xml=1

If the NameSpaceType value in the XML output displays as Managed, then the company is using Entra ID.

8 of 25

D:\ Initial Recon> AADInternals

Once confirmed that Megabigtech uses Entra ID, more information can be gathered by tools such as AADInternals.

AADInternals toolkit is a PowerShell module containing tools for enumerating Entra ID and Office 365.

Reference

9 of 25

D:\ Initial Recon > Microburst

Azure services are accessible through recognizable domains and subdomains. We can detect if the target organization utilizes these services by searching for such subdomains.

Microburst utilizes different PowerShell modules such as Az, AzureAD, AzureRM, and MSOL, along with additional REST API calls, to evaluate security in Azure environments.

Reference: https://github.com/NetSPI/MicroBurst

10 of 25

D:\ Initial Recon > Potential Usernames

Key Observations

Email format : first.last@megabigtech.com

Potential usernames

yuki.tanaka@megabigtech.com
yamamoto.sota@megabigtech.com
takahashi.hina@megabigtech.com
kato.sara@megabigtech.com

11 of 25

D:\ Initial Recon> Validating Usernames

Browsing to login.microsoftonline.com, If the username is valid we will be prompted to enter the password. Otherwise, we'll get the message “This username may be incorrect.”

12 of 25

D:\ Initial Recon> Automating Validation

Username Validation

Omnispray leverages o365spray and automates the manual validation of checking for valid usernames against login.microsoftonline.com

https://github.com/0xZDH/Omnispray

Password Validation

With Valid usernames, credential stuffing can be performed by tools such as MSOLSpray and Teamfiltration

Credential stuffing and password spraying attacks are definitely noisy(locking accounts), and so it's often worth exploring other options

13 of 25

Expanding Attack Surface

14 of 25

D:\ Expanding Attack Surface > mindset

Some good questions to ask after gaining a foothold with a compromised user

Is the user part of any group? If so, does this group has any role assigned to it?
Does the user have any Azure Entra ID roles assigned to them?
Which objects has this user created?
Is this user the owner of any service principal?

15 of 25

D:\ Expanding Attack Surface> Leveraging AzureAD Module

Enumerate All directory users

Get-AzureADUser -All $true

Gather information about a particular user

Get-AzureADUser -ObjectId yuki.tanaka@megabigtech.com | fl *

Search for user created resources

Get-AzureADUser -ObjectId yuki.tanaka@megabigtech.com | Get-AzureADUserCreatedObject

Enumerate resources owned by the current user

Get-AzureADUserOwnedObject -ObjectId yuki.tanaka@megabigtech.com

16 of 25

D:\ Expanding Attack Surface > Groups

Checking if the user is part of any groups

Get-AzureADUserMembership -ObjectId yuki.tanaka@megabigtech.com

��

�

17 of 25

D:\ Expanding Attack Surface> Leveraging Az Module

List what resources the current user has access to

Get-AzResource

Enumerate RBAC permissions the user has over the WebApp

Get-AzRoleAssignment -SignInName <user>

18 of 25

D:\ Expanding Attack Surface > App Service

Azure App Service is a Platform as a Service (PaaS) offering that enables developers to build and host web apps, mobile back ends, and RESTful APIs in the programming language of their choice without managing infrastructure.

Azure App Service offers auto-scaling and high availability, supports both Windows and Linux, and enables automated deployments from GitHub and Azure DevOps,

Website Contributor has access to Kudu. Kudu is the engine behind a number of features in Azure App Service and behind every App Service Web App is a KUDU Console that is used for debugging and monitoring. The important aspect here is if the web app is interacting with other services such as Azure SQL, Storage Account or Key Vault, then we will be able to access them in the privileged context of the app.

19 of 25

D:\ Expanding Attack Surface > Leveraging AzWebApp

Enumerating Interesting information about the Web App

Get-AzWebApp -Name megabigtechdevapp23 | select enabledhostnames

Source Control Manager, otherwise known as Kudu is the engine behind some features in Azure App Service that are related to source-control-based deployment and other deployment methods, like Dropbox and OneDrive sync.

20 of 25

D:\ Expanding Attack Surface > Hands On

21 of 25

Lateral Movement & Exploitation

22 of 25

D:\ Lateral Movement & Exploitation > Mindset

The Web App may be configured to connect to backend resources using a managed identity (which is the best practice). In which case we can check if environment variables like IDENTITY_ENDPOINT and IDENTITY_HEADER are present as those are required by Managed identity

https://github.com/ed2kurObi/HackMS I

Another option when configuring the web app is to use a connection string that is stored as an environment variable.

1 of 25