Cloud Focused Continuous Red Teaming: Avoiding the Fall of Icarus!

Research presented at SaintCon in Utah on October 26th 2022.

Session Name: "Cloud Focused Continuous Red Teaming: Avoiding the Fall of Icarus!"

Red Teaming and Penetration Testing of Cloud (AWS, Azure, GCP, etc.) environments is a rapidly evolving field. Every year new tools are being released and existing techniques are being further refined. This session covers the latest Cloud focused attack vectors and describes viable strategies on how to detect their malicious usage within your cloud environments.

Some of the topics covered include:
- How attackers go from zero to (Cloud) Admin
- Stealing of SSO Tokens and Browser Cookies to Bypass EDRs & go directly to Cloud Services
- Leverage Graph Database Technologies (e.g. Neo4j) to Discover Privilege Escalation Paths
- Methods for Bridging Cloud Environments to On-Premise Networks & Information Systems
- Techniques to Attack These Bridges & Methods to Persist For The Long Haul

Next, we will show how organizations can easily take their cybersecurity programs to the next-level via implementing a simple but effective Continuous Red Teaming program. With this rapidly evolving cloud focused threat landscape, and the endlessly sprawl of cloud resources, organizations are being forced to take a critical look at their security backlog of work, including the prioritization of remediating all of the known vulnerabilities. In addition, the limited availability of qualified human resources and competing business concerns (e.g. new features vs bug fixes) add additional strain on security, engineering and IT personnel to demonstrate the value add of closing common security issues (e.g. via path management programs, etc.). Continuous Testing programs enable organizations to focus on closing out the issues within their security backlog which will have the greatest Return on Investment (ROI) to an organization’s security posture.

Cloud expertise is not required since the presentation covers the basics of how Cloud environments are commonly implemented, while then highlighting the areas that are most useful for attackers. Information presented is useful for both Red Team & Blue Team members.

Transcript

1. https:// .Security Version 1.0 Copyright 2022 by Stage 2 Security Outplay Your Adversary! Bryce Kunz // @TweekFawkes
2. https:// .Security Version 1.0 Copyright 2022 by Stage 2 Security Avoiding the Fall of Icarus Cloud Focused Continuous Red Teaming
3. Copyright 2022 by Stage 2 Security https:// .Security Bryce Kunz @TweekFawkes - Who Am I? - Go From Zero to Cloud Admin! - SSO Tokens & Browser Cookies - Graph Database Technologies - Overview: Bridging to On-Prem - Attacking the Bridges! - One More Thing! Agenda
4. Copyright 2022 by Stage 2 Security https:// .Security Defense DHS SOC Offense NSA Red Team Adobe Digital Exp. (DX) Bryce Kunz; @TweekFawkes Services • Hack (Pentest) • Hunt (Splunk ES) • Train (Cloud Sec.)
5. Copyright 2022 by Stage 2 Security https:// .Security BSidesSLC.org Hardware Badge by @professor__plum Friday Dec. 16th 2022! Sandy UT Conference Center at Miller Campus https://BSidesSLC.org
6. Copyright 2022 by Stage 2 Security https:// .Security Go From Zero to Cloud Admin! Overview
7. Copyright 2022 by Stage 2 Security https:// .Security AWS Account External Resources Typical Steps: • Exploit App • Collect Creds • Reuse Creds Elastic Block Store (EBS) Volume Snapshot Elastic Compute Cloud (EC2) Instance Instances AWS IAM Role AWS STS Temporary Credentials Temporary Credentials Policies Identities Global Cloud
8. Copyright 2022 by Stage 2 Security https:// .Security AWS Account Globally Shared Resources: • EC2 AMIs • EBS Snapshots • RDS Snapshots • etc… Elastic Block Store (EBS) Volume Snapshot Elastic Compute Cloud (EC2) Instance Instances Global Cloud Secrets
9. Copyright 2022 by Stage 2 Security https:// .Security AWS Account Client-Side Vectors: • RCE • Cookies • Phishing • AiTM • Supply Chain • Social Engineering • Extensions • etc… Elastic Block Store (EBS) Volume Snapshot Elastic Compute Cloud (EC2) Instance Instances AWS IAM Role AWS STS Temporary Credentials Policies Identities Global Cloud Admin
10. Copyright 2022 by Stage 2 Security https:// .Security SSO Tokens & Browser Cookies Overview
11. Copyright 2022 by Stage 2 Security https:// .Security Overview Methods Include: • Malicious Browser Extension • Adversary-in-the-Middle (AiTM) Other Common Methods Include: • Malicious Documents (e.g. Office Macros) • Malicious Applications
12. Copyright 2022 by Stage 2 Security https:// .Security Malicious Browser Extensions
13. Copyright 2022 by Stage 2 Security https:// .Security Kevin L. Shout Out! …
14. Copyright 2022 by Stage 2 Security https:// .Security Malicious Browser Extension Users Evil Server SSO / App TLS Browser
15. Copyright 2022 by Stage 2 Security https:// .Security CursedChrome Red Team Toolkit Options https://github.com/mandatoryprogrammer/CursedChrome
16. Copyright 2022 by Stage 2 Security https:// .Security Defense: Enterprise Policies (e.g. Chrome) Users Evil Server SSO / App TLS Browser https://github.com/mandatoryprogrammer/ChromeGalvanizer
17. Copyright 2022 by Stage 2 Security https:// .Security Adversary-in-the-Middle (AiTM)
18. Copyright 2022 by Stage 2 Security https:// .Security Brad H. Shout Out! …
19. Copyright 2022 by Stage 2 Security https:// .Security Adversary-in-the-Middle (AiTM) Users Evil Proxy SSO / App TLS TLS Browser
20. Copyright 2022 by Stage 2 Security https:// .Security Phishing + AiTM Evil Proxy SSO / App TLS TLS Browser Users Email
21. Copyright 2022 by Stage 2 Security https:// .Security Browser Access Evil Proxy SSO / App TLS TLS Browser Users Email Browser TLS
22. Copyright 2022 by Stage 2 Security https:// .Security SaaS & Cloud Access Evil Proxy SSO / App TLS TLS Browser Users Email Browser TLS SaaS / CSP TLS
23. Copyright 2022 by Stage 2 Security https:// .Security EDRs: 2022 -> Largely Ignore Browser Sessions! Evil Proxy SSO / App TLS TLS Browser Users Email Browser TLS SaaS / CSP TLS EDR EDR Cloud
24. Copyright 2022 by Stage 2 Security https:// .Security AiTM Evilginx2 https://github.com/kgretzky/evilginx2 https://github.com/drk1wi/Modlishka https://github.com/muraenateam/muraena https://github.com/ustayready/CredSniper Phishing GoPhish https://github.com/gophish/gophish https://github.com/pentestgeek/phishing-frenzy https://github.com/rsmusllp/king-phisher Red Team Toolkit Options
25. Copyright 2022 by Stage 2 Security https:// .Security AiTM Evilginx2 Phishing GoPhish Red Team Toolkit Options = EvilGoPhish https://github.com/fin3ss3g0d/evilgophish +
26. Copyright 2022 by Stage 2 Security https:// .Security Defense: Incorrect FQDN Okta-Test.com Okta.com TLS TLS Browser Users Email Browser TLS SaaS / CSP TLS EDR EDR Cloud
27. Copyright 2022 by Stage 2 Security https:// .Security Defense: FIDO2 (Hardware/YubiKey) + WebAuthn Okta-Test.com Okta.com TLS TLS Browser Users Email Browser TLS SaaS / CSP TLS EDR EDR Cloud
28. Copyright 2022 by Stage 2 Security https:// .Security Graph Database Technologies Overview
29. Copyright 2022 by Stage 2 Security https:// .Security Paul W. & Michael B. Shout Out! …
30. Copyright 2022 by Stage 2 Security https:// .Security Why Graph DBs?
31. Copyright 2022 by Stage 2 Security https:// .Security … Quickly Find Priv Esc Paths
32. Copyright 2022 by Stage 2 Security https:// .Security … 1. Set The Goal
33. Copyright 2022 by Stage 2 Security https:// .Security … 2. Generate Inbound Paths
34. Copyright 2022 by Stage 2 Security https:// .Security … 3. Analyze the Paths for Access Vectors
35. Copyright 2022 by Stage 2 Security https:// .Security But How Are All Those Lines Useful?
36. Copyright 2022 by Stage 2 Security https:// .Security
37. Copyright 2022 by Stage 2 Security https:// .Security IAM Roles
38. Copyright 2022 by Stage 2 Security https:// .Security AWS Account Identity and Access Management (IAM) IAM Users Permissions Policy Action sts:AssumeRole Resource arn…role/rds-ro IAM User joe AWS IAM Users & AWS Service RDS, &... Relational Database Service (RDS) DB Cluster Secrets
39. Copyright 2022 by Stage 2 Security https:// .Security AWS Account Identity and Access Management (IAM) IAM Users Permissions Policy Action sts:AssumeRole Resource arn…role/rds-ro IAM User joe AWS IAM Users & AWS Service RDS, &... Relational Database Service (RDS) DB Cluster Secrets Blocked! Requires… Action rds:Describe*
40. Copyright 2022 by Stage 2 Security https:// .Security AWS Account Identity and Access Management (IAM) IAM Roles Permissions Policy What can be done with the role Action rds:Describe* Resource * Role rds-ro AWS IAM Roles & Policies
41. Copyright 2022 by Stage 2 Security https:// .Security AWS Account Identity and Access Management (IAM) IAM Roles Permissions Policy What can be done with the role Action rds:Describe* Resource * Role rds-ro AWS IAM Roles & Policies Relational Database Service (RDS) DB Cluster Secrets
42. Copyright 2022 by Stage 2 Security https:// .Security AWS Account Identity and Access Management (IAM) IAM Roles Trust Policy aka “AssumeRolePolicy” Who can assume the role Principal arn…user/joe Action sts:AssumeRole Permissions Policy What can be done with the role Action rds:Describe* Resource * Role rds-ro AWS IAM Roles & Policies
43. Copyright 2022 by Stage 2 Security https:// .Security AWS Account Identity and Access Management (IAM) IAM Roles Trust Policy aka “AssumeRolePolicy” Who can assume the role Principal arn…user/joe Action sts:AssumeRole Permissions Policy What can be done with the role Action rds:Describe* Resource * Role rds-ro AWS IAM Roles & Policies Relational Database Service (RDS) DB Cluster Secrets
44. Copyright 2022 by Stage 2 Security https:// .Security AWS Account Identity and Access Management (IAM) IAM Users IAM Roles Trust Policy aka “AssumeRolePolicy” Who can assume the role Principal arn…user/joe Action sts:AssumeRole Permissions Policy What can be done with the role Action rds:Describe* Resource * Role rds-ro Permissions Policy Action sts:AssumeRole Resource arn…role/rds-ro IAM User joe AWS IAM Users & IAM Roles
45. Copyright 2022 by Stage 2 Security https:// .Security AWS Account Identity and Access Management (IAM) IAM Users IAM Roles Trust Policy aka “AssumeRolePolicy” Who can assume the role Principal arn…user/joe Action sts:AssumeRole Permissions Policy What can be done with the role Action rds:Describe* Resource * Role rds-ro Permissions Policy Action sts:AssumeRole Resource arn…role/rds-ro IAM User joe AWS IAM Users, IAM Roles, & AWS Services Relational Database Service (RDS) DB Cluster Secrets
46. Copyright 2022 by Stage 2 Security https:// .Security iam:PassRole
47. Copyright 2022 by Stage 2 Security https:// .Security AWS Account Identity and Access Management (IAM) IAM Users Permissions Policy AmazonEC2FullAccess Resource * IAM User rydia App on EC2 Instance, Needs S3 Objects, &... Simple Storage Service (S3) AWS EC2 Instances App Objects S3 Bucket Secrets
48. Copyright 2022 by Stage 2 Security https:// .Security AWS Account Identity and Access Management (IAM) IAM Users Permissions Policy AmazonEC2FullAccess Resource * IAM User rydia App on EC2 Instance, Needs S3 Objects, &... Simple Storage Service (S3) AWS EC2 Instances App Objects S3 Bucket Secrets Blocked! Requires… Action s3:Get*
49. Copyright 2022 by Stage 2 Security https:// .Security AWS Account IAM Users Permissions Policy AmazonEC2FullAccess Resource * IAM User rydia Attach Role to Instance, &… Simple Storage Service (S3) AWS EC2 Instances App Objects S3 Bucket Secrets IAM Instance Profile Instance Profile ec2-s3-ro Role ec2-s3-ro Identity and Access Management (IAM)
50. Copyright 2022 by Stage 2 Security https:// .Security AWS Account Identity and Access Management (IAM) IAM Users IAM Roles Trust Policy aka “AssumeRolePolicy” Who can assume the role Principal Service EC2 Action sts:AssumeRole Permissions Policy What can be done with the role AmazonS3ReadOnlyAccess Resource * Role ec2-s3-ro Permissions Policy AmazonEC2FullAccess Resource * IAM User rydia Attach Role to Instance, &… Simple Storage Service (S3) AWS EC2 Instances App Objects S3 Bucket Secrets IAM Instance Profile Instance Profile ec2-s3-ro Role ec2-s3-ro
51. Copyright 2022 by Stage 2 Security https:// .Security AWS Account Identity and Access Management (IAM) IAM Users IAM Roles Trust Policy aka “AssumeRolePolicy” Who can assume the role Principal Service EC2 Action sts:AssumeRole Permissions Policy What can be done with the role AmazonS3ReadOnlyAccess Resource * Role ec2-s3-ro Permissions Policy AmazonEC2FullAccess Resource * IAM User rydia Attach Role to Instance, &… Simple Storage Service (S3) AWS EC2 Instances App Objects S3 Bucket Secrets IAM Instance Profile Instance Profile ec2-s3-ro Role ec2-s3-ro Blocked! Requires… Action iam:PassRole*
52. Copyright 2022 by Stage 2 Security https:// .Security Create a Policy Allowing Pass Role Instances
53. Copyright 2022 by Stage 2 Security https:// .Security AWS Account Identity and Access Management (IAM) IAM Users IAM Roles Trust Policy aka “AssumeRolePolicy” Who can assume the role Principal Service EC2 Action sts:AssumeRole Permissions Policy What can be done with the role AmazonS3ReadOnlyAccess Resource * Role ec2-s3-ro Permissions Policy AmazonEC2FullAccess Resource * IAM User rydia Attach Role to Instance, &… Simple Storage Service (S3) AWS EC2 Instances App Objects S3 Bucket Secrets IAM Instance Profile Instance Profile ec2-s3-ro Role ec2-s3-ro New Policy pass-ec2-s3-ro
54. Copyright 2022 by Stage 2 Security https:// .Security AWS Account Identity and Access Management (IAM) IAM Users IAM Roles Trust Policy aka “AssumeRolePolicy” Who can assume the role Principal Service EC2 Action sts:AssumeRole Permissions Policy What can be done with the role AmazonS3ReadOnlyAccess Resource * Role ec2-s3-ro Permissions Policy AmazonEC2FullAccess Resource * pass-ec2-s3-ro IAM User rydia S3 Bucket Policies & S3 ACLs S3 AWS EC2 Instances App Objects Secrets IAM Instance Profile Instance Profile ec2-s3-ro Role ec2-s3-ro S3 Bucket Policies S3 ACLs S3 Bucket
55. Copyright 2022 by Stage 2 Security https:// .Security AWS Account Identity and Access Management (IAM) IAM Users IAM Roles Trust Policy aka “AssumeRolePolicy” Who can assume the role Principal Service EC2 Action sts:AssumeRole Permissions Policy What can be done with the role AmazonS3ReadOnlyAccess Resource * Role ec2-s3-ro Permissions Policy AmazonEC2FullAccess Resource * pass-ec2-s3-ro IAM User rydia Attach Role to Instance, &… AWS EC2 Instances App Objects S3 Bucket Secrets IAM Instance Profile Instance Profile ec2-s3-ro Role ec2-s3-ro S3 S3 Bucket Policies S3 ACLs
56. Copyright 2022 by Stage 2 Security https:// .Security S3 AWS Account Identity and Access Management (IAM) IAM Users IAM Roles Trust Policy aka “AssumeRolePolicy” Who can assume the role Principal Service EC2 Action sts:AssumeRole Permissions Policy What can be done with the role AmazonS3ReadOnlyAccess Resource * Role ec2-s3-ro Permissions Policy AmazonEC2FullAccess Resource * pass-ec2-s3-ro IAM User rydia Attach Role to Instance, &… AWS EC2 Instances App Objects S3 Bucket Secrets IAM Instance Profile Instance Profile ec2-s3-ro Role ec2-s3-ro S3 Bucket Policies S3 ACLs
57. Copyright 2022 by Stage 2 Security https:// .Security Scott P. Shout Out! …
58. Copyright 2022 by Stage 2 Security https:// .Security Basic Priv Esc Example via Graph DB
59. Copyright 2022 by Stage 2 Security https:// .Security … 1. Set The Goal
60. Copyright 2022 by Stage 2 Security https:// .Security … 2. Generate Inbound Paths
61. Copyright 2022 by Stage 2 Security https:// .Security … 3. Analyze the Paths for Access Vectors
62. Copyright 2022 by Stage 2 Security https:// .Security … IAM Policy with * Permissions!
63. Copyright 2022 by Stage 2 Security https:// .Security … Role w/ Trust Policy allowing EC2
64. Copyright 2022 by Stage 2 Security https:// .Security … Instance Profile to Role
65. Copyright 2022 by Stage 2 Security https:// .Security … iam:PasRole Permissions within Policy
66. Copyright 2022 by Stage 2 Security https:// .Security … IAM User with Permissions Policy
67. Copyright 2022 by Stage 2 Security https:// .Security … Compromise of “privesc3-…” User… To Admin Access!
68. Copyright 2022 by Stage 2 Security https:// .Security … Compromise of “privesc3-…” User… To Admin Access!
69. Copyright 2022 by Stage 2 Security https:// .Security … Compromise of “privesc3-…” User… To Admin Access!
70. Copyright 2022 by Stage 2 Security https:// .Security … Compromise of “privesc3-…” User… To Admin Access!
71. Copyright 2022 by Stage 2 Security https:// .Security … Compromise of “privesc3-…” User… To Admin Access!
72. Copyright 2022 by Stage 2 Security https:// .Security Create New EC2 Instance w/ Role Attached Instance Role Temporary Credentials Policies Instance Profile Simple Storage Service (S3) Objects S3 Bucket Secrets Elastic Compute Cloud (EC2) AWS IAM
73. Copyright 2022 by Stage 2 Security https:// .Security … Compromise of “privesc3-…” User… To Admin Access!
74. Copyright 2022 by Stage 2 Security https:// .Security Get Access To EC2 Instance via Connect Back to NC Instance Role Temporary Credentials Policies Instance Profile User Data Launch Script Simple Storage Service (S3) Objects S3 Bucket Secrets Elastic Compute Cloud (EC2) AWS IAM NetCat Listener
75. Copyright 2022 by Stage 2 Security https:// .Security C2 via NetCat Instance Role Temporary Credentials Policies Instance Profile Simple Storage Service (S3) Objects S3 Bucket Secrets C2 Elastic Compute Cloud (EC2) AWS IAM NetCat Listener
76. Copyright 2022 by Stage 2 Security https:// .Security …
77. Copyright 2022 by Stage 2 Security https:// .Security Elastic Compute Cloud (EC2) Access Metadata via Curl 169.254. 169.254 Instance AWS IAM Role Temporary Credentials Policies Instance Profile NetCat Listener Metadata Service Simple Storage Service (S3) Objects S3 Bucket Secrets C2
78. Copyright 2022 by Stage 2 Security https:// .Security Elastic Compute Cloud (EC2) Access Metadata via Curl 169.254. 169.254 To Collect Creds! Instance AWS IAM Role Temporary Credentials Policies Instance Profile NetCat Listener Metadata Service Temporary Credentials Simple Storage Service (S3) Objects S3 Bucket Secrets C2
79. Copyright 2022 by Stage 2 Security https:// .Security … Compromise of “privesc3-…” User… To Admin Access!
80. Copyright 2022 by Stage 2 Security https:// .Security Elastic Compute Cloud (EC2) Configure aws cli Instance AWS IAM Role Temporary Credentials Policies Instance Profile NetCat Listener Metadata Service Temporary Credentials Simple Storage Service (S3) Objects S3 Bucket Secrets C2
81. Copyright 2022 by Stage 2 Security https:// .Security … Compromise of “privesc3-…” User… To Admin Access!
82. Copyright 2022 by Stage 2 Security https:// .Security Elastic Compute Cloud (EC2) Reuse Creds for S3 Access! Instance AWS IAM Role Temporary Credentials Policies Instance Profile NetCat Listener Metadata Service Temporary Credentials Simple Storage Service (S3) Objects S3 Bucket Secrets C2
83. Copyright 2022 by Stage 2 Security https:// .Security … Compromise of “privesc3-…” User… To Admin Access!
84. Copyright 2022 by Stage 2 Security https:// .Security Common Priv Esc Access Vectors
85. Copyright 2022 by Stage 2 Security https:// .Security Common Priv Esc Access Vectors IAM Permissions Manipulating Resources
86. Copyright 2022 by Stage 2 Security https:// .Security Common Priv Esc Access Vectors IAM Permissions Manipulating Resources Users iam:CreateAccessKey iam:UpdateLoginProfile iam:AddUserToGroup etc…
87. Copyright 2022 by Stage 2 Security https:// .Security Common Priv Esc Access Vectors IAM Permissions Manipulating Resources Users iam:CreateAccessKey iam:UpdateLoginProfile iam:AddUserToGroup etc… Permissions Policies iam:CreatePolicyVersion iam:SetDefaultPolicyVersion iam:Attach*Policy iam:Put*Policy etc…
88. Copyright 2022 by Stage 2 Security https:// .Security Common Priv Esc Access Vectors IAM Permissions Manipulating Resources Users iam:CreateAccessKey iam:UpdateLoginProfile iam:AddUserToGroup etc… Permissions Policies iam:CreatePolicyVersion iam:SetDefaultPolicyVersion iam:Attach*Policy iam:Put*Policy etc… AssumeRole Policies iam:UpdateAssumeRolePolicy + sts:AssumeRole
89. Copyright 2022 by Stage 2 Security https:// .Security Common Priv Esc Access Vectors IAM Permissions Manipulating Resources Users iam:CreateAccessKey iam:UpdateLoginProfile iam:AddUserToGroup etc… Permissions Policies iam:CreatePolicyVersion iam:SetDefaultPolicyVersion iam:Attach*Policy iam:Put*Policy etc… AssumeRole Policies iam:UpdateAssumeRolePolicy + sts:AssumeRole PassRole Policies iam:PassRole + Processing Data
90. Copyright 2022 by Stage 2 Security https:// .Security Common Priv Esc Access Vectors IAM Permissions Manipulating Resources Users iam:CreateAccessKey iam:UpdateLoginProfile iam:AddUserToGroup etc… Permissions Policies iam:CreatePolicyVersion iam:SetDefaultPolicyVersion iam:Attach*Policy iam:Put*Policy etc… AssumeRole Policies iam:UpdateAssumeRolePolicy + sts:AssumeRole Resources Processing Data PassRole Policies iam:PassRole + Processing Data Create New Affect Inputs
91. Copyright 2022 by Stage 2 Security https:// .Security Common Priv Esc Access Vectors IAM Permissions Manipulating Resources Users iam:CreateAccessKey iam:UpdateLoginProfile iam:AddUserToGroup etc… Permissions Policies iam:CreatePolicyVersion iam:SetDefaultPolicyVersion iam:Attach*Policy iam:Put*Policy etc… AssumeRole Policies iam:UpdateAssumeRolePolicy + sts:AssumeRole Resources Processing Data PassRole Policies iam:PassRole + Processing Data Create New Affect Inputs Lambda lambda:UpdateFunctionCode lambda:PublishLayerVersion + Function w/ Role
92. Copyright 2022 by Stage 2 Security https:// .Security Common Priv Esc Access Vectors IAM Permissions Manipulating Resources Users iam:CreateAccessKey iam:UpdateLoginProfile iam:AddUserToGroup etc… Permissions Policies iam:CreatePolicyVersion iam:SetDefaultPolicyVersion iam:Attach*Policy iam:Put*Policy etc… AssumeRole Policies iam:UpdateAssumeRolePolicy + sts:AssumeRole Resources Processing Data PassRole Policies iam:PassRole + Processing Data Create New Affect Inputs SSM & EC2 SendCommand StartSession + Instance Profile w/ Role Lambda lambda:UpdateFunctionCode lambda:PublishLayerVersion + Function w/ Role
93. Copyright 2022 by Stage 2 Security https:// .Security Common Priv Esc Access Vectors IAM Permissions Manipulating Resources Users iam:CreateAccessKey iam:UpdateLoginProfile iam:AddUserToGroup etc… Permissions Policies iam:CreatePolicyVersion iam:SetDefaultPolicyVersion iam:Attach*Policy iam:Put*Policy etc… AssumeRole Policies iam:UpdateAssumeRolePolicy + sts:AssumeRole Resources Processing Data PassRole Policies iam:PassRole + Processing Data Create New Affect Inputs SSM & EC2 SendCommand StartSession + Instance Profile w/ Role Lambda lambda:UpdateFunctionCode lambda:PublishLayerVersion + Function w/ Role AWS Services Numerous… e.g. w/ a Role
94. Copyright 2022 by Stage 2 Security https:// .Security Lab Environments & Tooling
95. Copyright 2022 by Stage 2 Security https:// .Security AiTM Evilginx2 • https://cloud.hacktricks.xyz/pentesting-cloud/aws-security • https://github.com/BishopFox/iam-vulnerable • https://github.com/RhinoSecurityLabs/cloudgoat • https://github.com/bridgecrewio/terragoat • https://github.com/nccgroup/sadcloud • https://hackingthe.cloud/aws/capture_the_flag/cicdont • https://github.com/ine-labs/AWSGoat Vulnerable Lab Environments CloudGoat
96. Copyright 2022 by Stage 2 Security https:// .Security … Visualization • https://github.com/nccgroup/PMapper • https://github.com/Azure/Stormspotter • https://github.com/duo-labs/cloudmapper • https://github.com/WithSecureLabs/awspx • https://github.com/SygniaLabs/security-cloud-scout • https://github.com/BloodHoundAD/BloodHound • https://pentestbook.six2dez.com/enumeration/cloud/azure Steps: 1. Collection 2. Processing 3. Analysis
97. Copyright 2022 by Stage 2 Security https:// .Security Tailored Collection & Processing + Neo4j GraphDB Aws Cloud Capability Tool (ACCT)
98. Copyright 2022 by Stage 2 Security https:// .Security Overview: Bridging to On-Prem Overview
99. Copyright 2022 by Stage 2 Security https:// .Security Overview: Bridging to On-Prem Includes: • Azure AD Overview • Azure AD Joined Endpoint • Azure AD Integration w/ On-Premises Active Directory ◦ Password Hash Synchronization (PHS) ◦ Pass Through Authentication (PTA) ◦ Active Directory Federated Services (ADFS) • Attacking the Bridges
100. Copyright 2022 by Stage 2 Security https:// .Security Azure AD Overview Overview
101. Copyright 2022 by Stage 2 Security https:// .Security Anthony H. Shout Out! …
102. Copyright 2022 by Stage 2 Security https:// .Security Azure AD Overview Identity Management Platform for: • Microsoft Applications e.g. Office 365 • Azure Resource Manager (ARM) • 3rd Party (SaaS/Cloud) Applications https:/ /docs.microsoft.com/en-gb/azure/active-directory/manage-apps/what-is-application-management
103. Copyright 2022 by Stage 2 Security https:// .Security Azure AD != Active Directory Comparison... https:/ /troopers.de/downloads/troopers19/TROOPERS19_AD_Im_in_your_cloud.pdf Active Directory (Windows Server) Azure Active Directory (Azure AD) LDAP REST APIs NTLM, Kerberos OAuth, SAML, OpenID, etc. Structured Directory (OU tree) Flat Structure GPOs No GPOs Fine-Tuned Access Controls Predefined Roles Domain, Forest Tenant Trusts Guests
104. Copyright 2022 by Stage 2 Security https:// .Security Azure AD Management Tools - Web Portal Management tools for Azure AD: • Azure Portal - https://portal.azure.com https:/ /www.synacktiv.com/posts/pentest/azure-ad-introduction-for-red-teamers.html
105. Copyright 2022 by Stage 2 Security https:// .Security Azure AD Management Tools - PS Management tools for Azure AD: • PowerShell Modules ◦ MSOnline, MSOnline V1 PowerShell module ▪ Install-Module -Name MSOnline ◦ AzureAD, Azure Active Directory V2 PowerShell ▪ Install-Module -Name AzureAD https:/ /www.synacktiv.com/posts/pentest/azure-ad-introduction-for-red-teamers.html
106. Copyright 2022 by Stage 2 Security https:// .Security PowerShell - MSOnline - Auth Load: Import-Module MSOnline Auth: Connect-MsolService (or) $creds = Get-Credential Connect-MsolService -Credential $creds https:/ /github.com/dafthack/CloudPentestCheatsheets/blob/master/cheatsheets/Azure.md
107. Copyright 2022 by Stage 2 Security https:// .Security PowerShell - MSOnline - Commands https:/ /github.com/dafthack/CloudPentestCheatsheets/blob/master/cheatsheets/Azure.md PS Command Desc Get-MSolCompanyInformation List Company Information Get-MSolUser -All List all users Get-MSolGroup -All List all groups Get-MsolRole -RoleName "Company Administrator" Get-MSolGroupMember –GroupObjectId $GUID List members of a group (Global Admins in this case) Get-MSolUser –All | fl List all user attributes Get-MsolServicePrincipal List Service Principals
108. Copyright 2022 by Stage 2 Security https:// .Security PowerShell - Azure AD - Auth Load: Import-Module Az Auth: Connect-AzAccount (or) $creds = Get-Credential Connect-AzAccount -Credential $creds https:/ /github.com/dafthack/CloudPentestCheatsheets/blob/master/cheatsheets/Azure.md
109. Copyright 2022 by Stage 2 Security https:// .Security PowerShell - Azure AD - Commands https:/ /github.com/dafthack/CloudPentestCheatsheets/blob/master/cheatsheets/Azure.md PS Command Desc Get-AzContext -ListAvailable List Context Get-AzSubscription List Subscriptions Select-AzSubscription -SubscriptionID "<ID>" Select a Subscription Get-AzRoleAssignment Current user's role assignment Get-AzResourceGroup List resource groups Get-AzResource List resources Get-AzStorageAccount List storage accounts
110. Copyright 2022 by Stage 2 Security https:// .Security Azure AD Management Tools - CLI Management tools for Azure AD: • Azure CLI ◦ v1 - Azure Classic CLI (w/ ARM Support) ◦ v2 - Azure CLI - AAD platform (v1.0) ◦ v3? (currently beta) - Azure CLI - Microsoft Identity platform (v2.0) https:/ /www.synacktiv.com/posts/pentest/azure-ad-introduction-for-red-teamers.html
111. Copyright 2022 by Stage 2 Security https:// .Security Azure CLI - AAD platform (v1.0) - Auth Auth: az login https:/ /github.com/dafthack/CloudPentestCheatsheets/blob/master/cheatsheets/Azure.md
112. Copyright 2022 by Stage 2 Security https:// .Security Azure AD Management Tools - .NET Management tools for Azure AD: • .NET Libraries https:/ /docs.microsoft.com/en-us/dotnet/api/overview/azure/activedirectory?view=azure-dotnet
113. Copyright 2022 by Stage 2 Security https:// .Security Azure AD Management APIs Management technologies and techniques (APIs) for Azure AD: • APIs: ◦ Microsoft Graph ◦ Azure AD Graph ◦ Exchange Provisioning Service https:/ /www.youtube.com/watch?v=o5QDt30Pw_o
114. Copyright 2022 by Stage 2 Security https:// .Security Azure AD Management APIs Management technologies and techniques (APIs) for Azure AD: • APIs: ◦ Microsoft Graph ◦ Azure AD Graph ◦ Exchange Provisioning Service https:/ /www.youtube.com/watch?v=o5QDt30Pw_o
115. Copyright 2022 by Stage 2 Security https:// .Security Azure AD Management APIs ◦ https:/ /www.youtube.com/watch?v=o5QDt30Pw_o Azure Web Portal Azure Portal API Internal Azure AD Graph API
116. Copyright 2022 by Stage 2 Security https:// .Security Azure AD Management APIs ◦ https:/ /www.youtube.com/watch?v=o5QDt30Pw_o Azure Web Portal Azure Portal API Internal Azure AD Graph API
117. Copyright 2022 by Stage 2 Security https:// .Security Azure AD Management APIs ◦ https:/ /www.youtube.com/watch?v=o5QDt30Pw_o Azure Web Portal Azure Portal API Internal Azure AD Graph API
118. Copyright 2022 by Stage 2 Security https:// .Security Azure AD Management APIs Management technologies and techniques (APIs) for Azure AD: • APIs: ◦ Microsoft Graph ◦ Azure AD Graph ▪ Internal Azure AD Graph API ◦ Exchange Provisioning Service https:/ /www.youtube.com/watch?v=o5QDt30Pw_o
119. Copyright 2022 by Stage 2 Security https:// .Security Azure AD Licenses Different Licenses • Free. • Premium P1 (6$ user/month). • Premium P2 (9$ user/month). http:/ /www.rebeladmin.com/2016/09/azure-active-directory-edition-buy/
120. Copyright 2022 by Stage 2 Security https:// .Security Microsoft Identity platform (v2.0) “AAD authentication platform (v1.0) is being deprecated.” “Microsoft Identity platform (v2.0) is the new authentication method and is used by Azure CLI beta.” Microsoft identity platform (v2.0) is an evolution of the Azure Active Directory (Azure AD) developer platform (v1.0). https:/ /docs.microsoft.com/en-us/cli/azure/install-azure-cli-windows?view=azure-cli-latest&tabs=azure-cli https:/ /docs.microsoft.com/en-us/azure/active-directory/azuread-dev/azure-ad-endpoint-comparison https:/ /docs.microsoft.com/en-us/azure/active-directory/azuread-dev/v1-overview
121. Copyright 2022 by Stage 2 Security https:// .Security Azure AD Joined Astute Hunting
122. Copyright 2022 by Stage 2 Security https:// .Security Azure AD Joined Endpoint ... https:/ /jairocadena.com/2016/02/01/azure-ad-join-what-happens-behind-the-scenes/
123. Copyright 2022 by Stage 2 Security https:// .Security Azure AD Join (Windows 10) • User chooses to join device to Azure AD. • User authenticates and provides an MFA proof (if configured). • User accepts terms from MDM system (if applicable). • Device registers with Azure AD. • Device enrolls into MDM system and gets sign-in policy (if applicable). • User signs into Windows. • User provisions Microsoft Passport for Work. • Device encryption is enabled and BitLocker key is escrowed to Azure AD. • User enterprise settings are applied. https:/ /jairocadena.com/2016/02/01/azure-ad-join-what-happens-behind-the-scenes/
124. Copyright 2022 by Stage 2 Security https:// .Security Azure AD Request Tokens Azure AD connected computers store a token that can be used as a token for authentication The token is used for single sign on (SSO) for Microsoft Resources The token can be stolen and used to login as a domain user https:/ /dirkjanm.io/abusing-azure-ad-sso-with-the-primary-refresh-token/
125. Copyright 2022 by Stage 2 Security https:// .Security Stealing Azure AD Request Tokens Using Voodoo, we execute a program that steals a JWT token That token is then used to login as the domain user https:/ /posts.specterops.io/requesting-azure-ad-request-tokens-on-azure-ad-joined-machines-for-browser-sso-2b0409caad30
126. Copyright 2022 by Stage 2 Security https:// .Security Logan Shout Out! …
127. Copyright 2022 by Stage 2 Security https:// .Security Demo: AADRefreshToken
128. Copyright 2022 by Stage 2 Security https:// .Security Integration w/ on- premises Active Directory Astute Hunting
129. Copyright 2022 by Stage 2 Security https:// .Security Azure AD-Connect Authentication Methods:: • Password Hash Synchronization (PHS) • Pass Through Authentication (PTA) • Active Directory Federated Services (ADFS) https:/ /docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-azure-ad-connect
130. Copyright 2022 by Stage 2 Security https:// .Security Password Hash Synchronization (PHS) Password hashes of Active Directory users do not transit over the network. A hash, of each password hash, is being sent. https:/ /docs.microsoft.com/fr-fr/azure/active-directory/hybrid/reference-connect-accounts-permissions
131. Copyright 2022 by Stage 2 Security https:// .Security Password Hash Synchronization (PHS) Compromised Azure AD connect Sync account == Compromised AD C:\Program Files\Microsoft Azure AD Sync\Data\ADSync.mdf + DPAPI + AES https:/ /blog.fox-it.com/2019/06/06/syncing-yourself-to-global-administrator-in-azure-active-directory/ https:/ /www.youtube.com/watch?v=JEIR5oGCwdg https:/ /www.slideshare.net/DirkjanMollema/im-in-your-cloud-reading-everyones-email-hacking-azure-ad-via-active-directory
132. Copyright 2022 by Stage 2 Security https:// .Security Pass-Through Authentication (PTA) https:/ /blogvaronis2.wpengine.com/azure-skeleton-key/
133. Copyright 2022 by Stage 2 Security https:// .Security Pass-Through Authentication (PTA) ... https:/ /blog.xpnsec.com/azuread-connect-for-redteam/ https:/ /gist.github.com/xpn/f12b145dba16c2eebdd1c6829267b90c
134. Copyright 2022 by Stage 2 Security https:// .Security Active Directory Federation Services (ADFS) https:/ /docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-single-adfs-multitenant-federation
135. Copyright 2022 by Stage 2 Security https:// .Security Ask yourself if you still really need ADFS? https:/ /www.vansurksum.com/2019/08/05/ask-yourself-if-you-still-really-need-adfs/
136. Copyright 2022 by Stage 2 Security https:// .Security Attacking the Bridges! Overview
137. Copyright 2022 by Stage 2 Security https:// .Security BloodHound-AzureAD Fork of the BloodHound UI containing Azure AD features https:/ /github.com/dirkjanm/BloodHound-AzureAD
138. Copyright 2022 by Stage 2 Security https:// .Security Azure StormSpotter Azure Red Team tool for enumerating Azure environments https:/ /github.com/Azure/Stormspotter
139. Copyright 2022 by Stage 2 Security https:// .Security Password Hash Synchronization (PHS) Password hashes of Active Directory users do not transit over the network. A hash, of each password hash, is being sent. https:/ /docs.microsoft.com/fr-fr/azure/active-directory/hybrid/reference-connect-accounts-permissions
140. Copyright 2022 by Stage 2 Security https:// .Security Password Hash Synchronization (PHS) Compromised Azure AD connect Sync account == Compromised AD C:\Program Files\Microsoft Azure AD Sync\Data\ADSync.mdf + DPAPI + AES https:/ /blog.fox-it.com/2019/06/06/syncing-yourself-to-global-administrator-in-azure-active-directory/ https:/ /www.youtube.com/watch?v=JEIR5oGCwdg https:/ /www.slideshare.net/DirkjanMollema/im-in-your-cloud-reading-everyones-email-hacking-azure-ad-via-active-directory
141. Copyright 2022 by Stage 2 Security https:// .Security Pass-Through Authentication (PTA) https:/ /blogvaronis2.wpengine.com/azure-skeleton-key/
142. Copyright 2022 by Stage 2 Security https:// .Security Pass-Through Authentication (PTA) ... https:/ /blog.xpnsec.com/azuread-connect-for-redteam/ https:/ /gist.github.com/xpn/f12b145dba16c2eebdd1c6829267b90c
143. Copyright 2022 by Stage 2 Security https:// .Security One More Thing! Overview
144. Copyright 2022 by Stage 2 Security https:// .Security Scott Piper @0xdabbad00 Shout Out! https://tldrsec.com/blog/lesser-known-aws-attacks/
145. Copyright 2022 by Stage 2 Security https:// .Security AWS Account - Client - #90210 AWS Account - Attacker - #31337 EC2 SocialStackSetSmother Instances AWS IAM Role Policies Admin Cloud Formation Template Stack Lambda Function
146. Copyright 2022 by Stage 2 Security https:// .Security SocialStackSetSmother Click Link In Email https://us-east-1.console.aws.amazon.com/cloud formation/home?region=us-east-1#/stacks/create /review?templateURL=https://TODO_BUCKET_NAME.s 3.amazonaws.com/TODO_TEMPLATE_NAME.yml&stackNa me=TODO_STACK_NAME https://aws.amazon.com/blogs/devops/construct-your-own-launch-stack-url/
147. Copyright 2022 by Stage 2 Security https:// .Security AWS Account - Client - #90210 AWS Account - Attacker - #31337 S3 EC2 SocialStackSetSmother Instances AWS IAM Role Policies Admin Public Object cf_template.yaml S3 Bucket API GW S3 Bucket Object results001.txt Endpoint Lambda Function Cloud Formation Template Stack Lambda Function Email AWS IAM Policies Role
148. Copyright 2022 by Stage 2 Security https:// .Security SocialStackSetSmother https://aws.amazon.com/blogs/devops/construct-your-own-launch-stack-url/
149. Copyright 2022 by Stage 2 Security https:// .Security AWS Account - Client - #90210 AWS Account - Attacker - #31337 S3 EC2 SocialStackSetSmother Instances AWS IAM Role Policies Admin Public Object cf_template.yaml S3 Bucket API GW S3 Bucket Object results001.txt Endpoint Lambda Function Cloud Formation Template Stack Lambda Function Email AWS IAM Policies Role AWS SAM
150. Copyright 2022 by Stage 2 Security https:// .Security SocialStackSetSmother Attacker Needs Targets AWS Account ID# To Follow The Path Back
151. Copyright 2022 by Stage 2 Security https:// .Security AWS Account - Client - #90210 AWS Account - Attacker - #31337 S3 EC2 SocialStackSetSmother Instances AWS IAM Role Policies Admin API GW S3 Bucket Object results001.txt Endpoint Lambda Function Cloud Formation Template Stack Lambda Function AWS IAM Policies Role AWS SAM
152. Copyright 2022 by Stage 2 Security https:// .Security AWS Account - Client - #90210 AWS Account - Attacker - #31337 S3 EC2 SocialStackSetSmother Instances AWS IAM Role Policies Admin Public Object cf_template.yaml S3 Bucket API GW S3 Bucket Object results001.txt Endpoint Lambda Function Cloud Formation Template Stack Lambda Function Email AWS IAM Policies Role AWS SAM
153. Copyright 2022 by Stage 2 Security https:// .Security SocialStackSetSmother Sample Code https://github.com/TweekFawkes/SocialStackSetSmother
154. Copyright 2022 by Stage 2 Security https:// .Security Trainings @ BlackHat & On-Site! Thank You! Training@Stage2Sec.com .sh @TweekFawkes
155. Copyright 2022 by Stage 2 Security https:// .Security End Overview