Andy Robbins Profile picture
Feb 16, 2023 9 tweets 4 min read Read on X
Azure App Service Web Apps are yet another #Azure service that supports managed identity assignments.

Here's how attackers can use #BARK to abuse those assignments: Image
There are at least 3 ways to achieve code execution on an Azure App Service Web App ("Azure Web App" from here on) instance:

1. The Kudu shell execution API endpoints
2. Poison deployment to include a web shell in the app
3. Find a cmd execution vulnerability in the deployed app
We'll focus on #1 - abusing the built-in Kudu shell execution endpoints.

This is the feature the Azure GUI uses as its "Debug Console" and is documented here: github.com/projectkudu/ku…

@kfosaaen discussed this in his August 2020 blog post here: netspi.com/blog/technical… Image
We can access this endpoint with either deployment credentials or an AzureRM-scoped JWT for a principal with Owner, Contributor, or Website Contributor role on the Web App.

You can use either with BARK's new cmdlet, Invoke-AzureRMWebAppShellCommand
Say you found clear-text application-scoped credentials for the Web App. Just base64-encode the username/password and provide that, the Kudu URI, and the command to Invoke-AzureRMWebAppShellCommand: Image
Or if you have an AzureRM-scoped JWT: Image
If the Web App has a Managed Identity assignment, we can use Invoke-AzureRMWebAppShellCommand to extract a JWT for the Managed Identity Service Principal: Image
As an attacker, we can now act as the service principal and gain whatever new privileges that service principal may have that we didn't have before.

Why should you care?

This is why:
Want to know more? Check out my blog post from yesterday: medium.com/p/c3adefccff95

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Andy Robbins

Andy Robbins Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @_wald0

Feb 17, 2023
This week I added 5 new functions to #BARK. A quick thread explaining each one with examples:
Get-ServicePrincipalOwner

List the current owner(s) of a specified #Azure AD Service Principal.

Example:
New-ServicePrincipalOwner

Add a new owner to an AAD Service Principal. Owners can add credentials to SPs and then auth as them.

Example:
Read 8 tweets
Feb 4, 2023
Interest check: should I continue developing this research? Read my notes here and please let me know if you think this is worth pursuing further.

Problem: attackers have been moving their C2 channels to legitimate services to evade detection, slip through block lists, etc.
Examples:

github.com/boku7/azureOut…
3xpl01tc0d3r.blogspot.com/2020/03/introd…

Defenders and vendors have to play catch-up whenever one of these novel C2 methods becomes popular.
I believe it's possible to proactively, semi-automatically discover these methods in existing and emerging cloud services. We can assess their attractiveness to attackers, vendors can make them less attractive and prioritize their own detection efforts.

How?
Read 15 tweets
Sep 20, 2022
#Azure Managed Identity assignments are "secure by default."

Dangerous attack paths can emerge around these assignments.

Here's those attack paths emerge, how attackers abuse them, and how defenders can eliminate them: 🧵
First we should understand what Managed Identities are. I think the best way is to understand the problem they are designed to solve.

We have a great recent example of this problem from the alleged Uber breach, where a PowerShell script may have been storing plain text creds:
This problem is not new and not surprising to many people:
Read 25 tweets
Sep 13, 2022
Tiered Administration is among the strongest security controls that exist.

But the vast majority of organizations do not use it.

Here is how you can get started using Tiered Administration TODAY in your #Azure environments: 🧵
First, understand the problem we are trying to solve with Tiered Administration:

Tiered Administration protects your most privileged assets from compromise in the event that less privileged assets are compromised.

It's the wombo combo of least privilege and defense in depth.
Do Tiered Administration effectively and you DRAMATICALLY reduce risks posed by ransomware actors, insider threats, etc.

Most efforts get stuck in the very first step: identifying which assets go into which tiers.

Here's how you do this:
Read 11 tweets
Aug 25, 2022
How to prevent Kerberoasting:

Kerberoasting is an incredibly powerful and reliable attack against Active Directory. In some situations it can result in an attacker becoming Domain Admin nearly instantaneously.

Here's how to prevent this attack: 🧵 Image
First we need to identify Active Directory users that are "kerberoastable" - possible targets for the attacker to choose to Kerberoast.

Kerberoast relies on a user having some value in their "serviceprincipalnames" attribute.

Find all of them instantly with no 3rd party tools:
dsquery has been built in to Windows Server since Server 2008. You also get it when installing RSAT.

Here's the command:

dsquery * "dc=contoso,dc=com" -filter "(&(objectcategory=user)(servicePrincipalName=*))" -attr distinguishedName servicePrincipalName
Read 12 tweets
Aug 8, 2022
Take a close look at BARK's functions and you will see that most of them are simple wrappers around basic REST API calls. This means it's very easy to extend BARK.

For example, BARK is missing a function to list virtual machines. Here's how easy this is to add: 🧵
Let's look at an existing function that lists objects in AzureRM, "Get-AllAzureRMResourceGroups":
The most "difficult" line we need to change is line 24. We must ensure we are hitting the right URL.

The Microsoft documentation can help us here. We will Google "azure api list virtual machines", and the first result is this page:

docs.microsoft.com/en-us/rest/api…
Read 7 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

:(