The Security Notebook

MS Azure

6 min read

Web Enumeration

Initial recon info about domain

login.microsoftonline.com/getuserrealm.srf?login=USERNAME@COMPANYNAME.onmicrosoft.com&xml=1

More enumeration

login.microsoftonline.com/COMPANYNAME.onmicrosoft.com/.well-known/openid-configuration

Powershell Enumeration

AADInternals - Discovery and Recon

Import-Module C:\AzAD\Tools\AADInternals\AADInternals.psd1 -Verbose

Enumerate:

-Get tenant name

-Authentication

-Brand name (usually same as directory name) -Domain name

 
AADIntLoginInformation -UserName root@COMPANYNAME.onmicrosoft.com

Get Tenant ID

 
AADIntTenantID -Domain COMPANYNAME.onmicrosoft.com

Get Tenant Domains

Get-AADIntTenantDomains -Domain COMPANYNAME.onmicrosoft.com

Enumerate Everything

Invoke-AADIntReconAsOutsider -DomainName COMPANYNAME.onmicrosoft.com

Enumerate Emails

Find emails via hunter.io or theHarvester or scrape from the website, Linkedin scraping**

Verify Email list to find which ones are valid (possible rate limiting)

Common Email Aliases:

contact@COMPANYNAME.onmicrosoft.com

admin@COMPANYNAME.onmicrosoft.com

sales@COMPANYNAME.onmicrosoft.com

root@COMPANYNAME.onmicrosoft.com

test@COMPANYNAME.onmicrosoft.com

info@COMPANYNAME.onmicrosoft.com

support@COMPANYNAME.onmicrosoft.com

hello@COMPANYNAME.onmicrosoft.com

editor@COMPANYNAME.onmicrosoft.com

webmaster@COMPANYNAME.onmicrosoft.com

privacy@COMPANYNAME.onmicrosoft.com

marketing@COMPANYNAME.onmicrosoft.com

jobs@COMPANYNAME.onmicrosoft.com

press@COMPANYNAME.onmicrosoft.com

careers@COMPANYNAME.onmicrosoft.com

help@COMPANYNAME.onmicrosoft.com

news@COMPANYNAME.onmicrosoft.com

feedback@COMPANYNAME.onmicrosoft.com

media@COMPANYNAME.onmicrosoft.com

hr@COMPANYNAME.onmicrosoft.com

advertising@COMPANYNAME.onmicrosoft.com

events@COMPANYNAME.onmicrosoft.com

pr@COMPANYNAME.onmicrosoft.com

legal@COMPANYNAME.onmicrosoft.com

team@COMPANYNAME.onmicrosoft.com

customerservice@COMPANYNAME.onmicrosoft.com

service@COMPANYNAME.onmicrosoft.com

editorial@COMPANYNAME.onmicrosoft.com

office@COMPANYNAME.onmicrosoft.com

advertise@COMPANYNAME.onmicrosoft.com

mail@COMPANYNAME.onmicrosoft.com

partners@COMPANYNAME.onmicrosoft.com

noreply@COMPANYNAME.onmicrosoft.com

no-reply@COMPANYNAME.onmicrosoft.com

donotreply@COMPANYNAME.onmicrosoft.com

no_reply@COMPANYNAME.onmicrosoft.com

do-not-reply@COMPANYNAME.onmicrosoft.com

C:\Python27\python.exe C:\AzAD\Tools\o365creeper\o365creeper.py -f C:\AzAD\Tools\emails.txt -o C:\AzAD\Tools\validemails.txt

Enumerate Azure Services

Import Module

Import-Module C:\AzAD\Tools\MicroBurst\MicroBurst.psm1 -Verbose

Find subdomains (possible rate limiting)

Invoke-EnumerateAzureSubDomains -Base COMPANYNAME -Verbose

Initial Access - Password Spray/Brute-Force

-Not recommended on actual assessment, might lead to detection. Only use as an absolute last resort

-Possible password style: june@2023 or summer@2023

Import-Module C:\AzAD\Tools\MSOLSpray\MSOLSPray.ps1
 Invoke-MSOLSpray -UserList C:\AzAD\Tools\validemails.txt -Password SuperVeryEasytoGuessPassword@1234 -Verbose

Initial Access Enumeration

-What’s our users role?

-Users

-Groups

-Roles

-Devices

-Enterprise Applications

Initial Access Enumeration - AzureAD Module

Import-Module C:\AzAD\Tools\AzureAD\AzureAD.psd1

Connect to Azure AD via Powershell

$passwd = example_value "Super!Secure!Password" -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential("test@COMPANYNAME.onmicrosoft.com",$passwd)
Connect-AzureAD -Credential $creds

Current Session State

Get-AzureADCurrentSessionInfo

Details of current tenant

Get-AzureADTenantDetail

Enumeration - AzureAD Module - Users

Enumerate All Users

Get-AzureADUser -All $true

Total user count

Get-AzureADUser -All $true | measure

Enumerate a Specific User

Get-AzureADUser -ObjectId test@COMPANYNAME.onmicrosoft.com |Format-List *

Search for the word ‘admin’ in DisplayName or UserPrincipleName

Get-AzureADUser -SearchString "admin”

Search for ‘admin’ in DisplayName

Get-AzureADUser -All $true |?{$_.Displayname-match"admin"}

Search all attributes for the word ‘password’.

Get-AzureADUser -All $true |%{$Properties = $_;$Properties.PSObject.Properties.Name | % {if ($Properties.$_ -match 'password') {"$($Properties.UserPrincipalName) - $_ - $($Properties.$_)"}}}

All Users Synced from On-Prem

Get-AzureADUser -All $true | ?{$_.OnPremisesSecurityIdentifier -ne $null}

All Users from AzureAD

Get-AzureADUser -All $true | ?{$_.OnPremisesSecurityIdentifier -eq $null}

Find objects created by Users

Get-AzureADUser | Get-AzureADUserCreatedObject

Objects Owned by a Specific User

Get-AzureADUserOwnedObject -ObjectId test@COMPANYNAME.onmicrosoft.com

Enumeration - AzureAD Module - Groups

Find all Groups

Get-AzureADGroup -All $true

Enumerate a Specific Group further

Get-AzureADGroup -ObjectId 783a312d-0de2-4490-92e4-539b0e4ee03e | Format-List *

Search for ‘admin’ in first characters of DisplayName

Get-AzureADGroup -SearchString "admin" | Format-List *

Search for ‘admin’ anywhere in the Name

Get-AzureADGroup -All $true | ?{$_.Displayname -match "admin"}

Find All Groups that Allow Dynamic Membership

Get-AzureADMSGroup | ?{$_.GroupTypes -eq 'DynamicMembership'}

Groups Synced from On-Prem

Get-AzureADGroup -All $true | ?{$_.OnPremisesSecurityIdentifier -ne $null}

Groups From AzureAD

Get-AzureADGroup -All $true | ?{$_.OnPremisesSecurityIdentifier -eq $null}

Find All Members of a Group

Get-AzureADGroupMember -ObjectId 783a312d-0de2-4490-92e4-539b0e4ee03e

Find All Groups and Roles where the specified user is a member

Get-AzureADUser -SearchString 'test' | Get-AzureADUserMembership
Get-AzureADUserMembership -ObjectId test@COMPANYNAMEq.onmicrosoft.com

Get All Available Role Templates (tends be more accurate than MS documentation)

Get-AzureADDirectoryroleTemplate

Get All Role’s Currently Assigned to Users

Get-AzureADDirectoryRole

Search for Global Admins

Get-AzureADDirectoryRole -Filter "DisplayName eq 'Global Administrator'" | Get-AzureADDirectoryRoleMember

Enumeration - AzureAD Module - Devices

Get All Azure Joined and Registered Devices

Get-AzureADDevice -All $true | select DisplayName,ApproximateLastLogonTimestamp
Get-AzureADDevice -All $true | fl *

Get Device Configuration (registration quota)

Get-AzureADDeviceConfiguration | fl *

List Registered Owners of All Devices

Get-AzureADDevice -All $true | % {if($user = Get-AzureADDeviceRegisteredOwner -ObjectId $_.ObjectID) {$_;$user.UserPrincipalName;"`n"}}

List Registered Users of All Devices

Get-AzureADDevice -All $true | % {if($user = Get-AzureADDeviceRegisteredUser -ObjectId $_.ObjectID){$_;$user.UserPrincipalName;"`n"}}

List Devices Owned by a Particular User

Get-AzureADUserOwnedDevice -ObjectId michaelmbarron@COMPANYNAME.onmicrosoft.com

List Devices Registered by a Particular User

Get-AzureADUserRegisteredDevice -ObjectId michaelmbarron@COMPANYNAME.onmicrosoft.com

List Devices Managed by Intune (don’t target, likely heavily managed, unless it’s a last resort)

Get-AzureADDevice -All $true | ? {$_.IsCompliant -eq "True"}

Enumeration - AzureAD Module - Applications

Get All Registered Applications

Get-AzureADApplication -All $true

Get Details about a particular Application

Get-AzureADApplication -ObjectId a1333e88-1278-41bf-8145-155a069ebed0 | fl *

Get Applications based on a search term

Get-AzureADApplication -All $true | ?{$_.DisplayName -match "app"}

Get All Applications that have a Password

Get-AzureADApplication -All $true | % {if(Get-AzureADApplicationPasswordCredential -ObjectID $_.ObjectID){$_}}

Get Owner of an Application

Get-AzureADApplication -ObjectId a1333e88-1278-41bf-8145-155a069ebed0 | Get-AzureADApplicationOwner | fl *

Get Apps where a User has a Role

Get-AzureADUser -ObjectId roygcain@COMPANYNAME.onmicrosoft.com | Get-AzureADUserAppRoleAssignment | fl *

Get Apps where a Group has a Role

Get-AzureADGroup -ObjectId 57ada729-a581-4d6f-9f16-3fe0961ada82 | Get-AzureADGroupAppRoleAssignment | fl *

Enumeration - AzureAD Module - Service Principles

-Enterprise Applications

Get All Service Principles

Get-AzureADServicePrincipal -All $true

Get Details about Specific Service Principle

Get-AzureADServicePrincipal -ObjectId cdddd16e-2611-4442-8f45-053e7c37a264 | fl *

Find a specific Service Principle based on Name

Get-AzureADServicePrincipal -All $true | ?{$_.DisplayName -match "app"}

List all Service Principles with a Password

Get-AzureADServicePrincipal -All $true | % {if(Get-AzureADServicePrincipalKeyCredential -ObjectID $_.ObjectID){$_}}

Get Owner of a Service Principle

Get-AzureADServicePrincipal -ObjectId cdddd16e-2611-4442-8f45-053e7c37a264 | Get-AzureADServicePrincipalOwner | fl *

Get objects Owned by a Service Principle

Get-AzureADServicePrincipal -ObjectId cdddd16e-2611-4442-8f45-053e7c37a264 | Get-AzureADServicePrincipalOwnedObject

Get Objects Created by Service Principle

Get-AzureADServicePrincipal -ObjectId cdddd16e-2611-4442-8f45-053e7c37a264 | Get-AzureADServicePrincipalCreatedObject

Get Group and Role Memberships for a Service Principle

Get-AzureADServicePrincipal -ObjectId cdddd16e-2611-4442-8f45-053e7c37a264 | Get-AzureADServicePrincipalMembership | fl *

AzureAD- Authentication and API’s

Generate Token for login to portal (access token)

(Get-AzAccessToken).Token

Request an access token for AAD Graph to access Azure AD. Supported tokens -AadGraph, AnalysisServices, Arm, Attestation, Batch, DataLake, KeyVault, MSGraph, OperationalInsights, ResourceManager, Storage, Synapse

Get-AzAccessToken -ResourceTypeName MSGraph

Login to Azure with Access Token on a different machine (token usually allows to bypass conditional access and MFA)

Connect-AzAccount -AccountId test@COMPANYNAME.onmicrosoft.com -AccessToken eyJ0eXA…

Using Tokens with REST API

$Token= example_value
 
$URI='https://management.azure.com/subscriptions?api-version=2020-01-01'
 
$RequestParams=@{
 
	Method ='GET'
 
	Uri =$URI
 
	Headers =@{
 
		'Authorization'="Bearer $Token"
 
		}
 
}
 
(Invoke-RestMethod @RequestParams).value

Using Tokens with MS Graph

$Token= example_value -ResourceTypeName MSGraph).Token
 
$URI='https://graph.microsoft.com/v1.0/users'
 
$RequestParams=@{
 
	Method ='GET'
 
	Uri =$URI
 
	Headers =@{
 
		'Authorization'="Bearer $Token"
 
		}
 
}
 
(Invoke-RestMethod @RequestParams).value

Enumeration - ROADTools

Authenticating to Azure via ROADRecon

 
cd C:\AzAD\Tools\ROADTools
 
pipenvshell
 
roadrecon auth -u test@COMPANYNAME.onmicrosoft.com -p SuperVeryEasytoGuessPassword@1234

Get Data and then Analyze Data

roadrecon gather
roadrecon gui

Enumeration - Stormspotter

Building out attack paths/graphs

Start back-end service

cd C:\AzAD\Tools\stormspotter\backend\
 
pipenv shell
 
python ssbackend.pyz

In a new process, Start the frontend webserver

cd C:\AzAD\Tools\stormspotter\frontend\dist\spa\
 
quasar.cmd serve -p9091 --history

In a new process, **Use Stormcollector to collect the data. **

 
cd C:\AzAD\Tools\stormspotter\stormcollector\
 
pipenv shell
 
az login -u test@COMPANYNAME.onmicrosoft.com -p ItW!llN0tAnEasyPassw0rdY0UCantGu3ss1t
 
python C:\AzAD\Tools\stormspotter\stormcollector\sscollector.pyz cli

Log-on to the webserver at http://localhost:9091

Username: neo4j

Password: example_value

Server: bolt://localhost:7687

-After login, upload the ZIP archive created by the collector.

-Use the built-in queries to visualize the data.

Enumeration - AzureHound

Execute the collector

Connect-AzAccount

Connect-AzureAD

C:\AzAD\Tools\AzureHound\AzureHound.ps1

Invoke-AzureHound -Verbose

AzureHound Query Cheat Sheet

https://hausec.com/2020/11/23/azurehound-cypher-cheatsheet/

Graph View