Tweet

@passthehashbrwn

@passthehashbrwn

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @_wald0

Andy Robbins

@_wald0

Feb 16

Azure App Service Web Apps are yet another #Azure service that supports managed identity assignments.

Here's how attackers can use #BARK to abuse those assignments:

There are at least 3 ways to achieve code execution on an Azure App Service Web App ("Azure Web App" from here on) instance:

1. The Kudu shell execution API endpoints
2. Poison deployment to include a web shell in the app
3. Find a cmd execution vulnerability in the deployed app

@kfosaaen

We'll focus on #1 - abusing the built-in Kudu shell execution endpoints.

This is the feature the Azure GUI uses as its "Debug Console" and is documented here: github.com/projectkudu/ku…

@kfosaaen discussed this in his August 2020 blog post here: netspi.com/blog/technical…

Read 9 tweets

Andy Robbins

@_wald0

Feb 4

Interest check: should I continue developing this research? Read my notes here and please let me know if you think this is worth pursuing further.

Problem: attackers have been moving their C2 channels to legitimate services to evade detection, slip through block lists, etc.

Examples:

github.com/boku7/azureOut…
3xpl01tc0d3r.blogspot.com/2020/03/introd…

Defenders and vendors have to play catch-up whenever one of these novel C2 methods becomes popular.

I believe it's possible to proactively, semi-automatically discover these methods in existing and emerging cloud services. We can assess their attractiveness to attackers, vendors can make them less attractive and prioritize their own detection efforts.

How?

Read 15 tweets

Andy Robbins

@_wald0

Sep 20, 2022

#Azure Managed Identity assignments are "secure by default."

Dangerous attack paths can emerge around these assignments.

Here's those attack paths emerge, how attackers abuse them, and how defenders can eliminate them: 🧵

First we should understand what Managed Identities are. I think the best way is to understand the problem they are designed to solve.

We have a great recent example of this problem from the alleged Uber breach, where a PowerShell script may have been storing plain text creds:

https://twitter.com/_wald0/status/1570811911503220740

This problem is not new and not surprising to many people:

https://twitter.com/_wald0/status/1570811911503220740

Read 25 tweets

Andy Robbins

@_wald0

Sep 13, 2022

Tiered Administration is among the strongest security controls that exist.

But the vast majority of organizations do not use it.

Here is how you can get started using Tiered Administration TODAY in your #Azure environments: 🧵

First, understand the problem we are trying to solve with Tiered Administration:

Tiered Administration protects your most privileged assets from compromise in the event that less privileged assets are compromised.

It's the wombo combo of least privilege and defense in depth.

Do Tiered Administration effectively and you DRAMATICALLY reduce risks posed by ransomware actors, insider threats, etc.

Most efforts get stuck in the very first step: identifying which assets go into which tiers.

Here's how you do this:

Read 11 tweets

Andy Robbins

@_wald0

Aug 25, 2022

How to prevent Kerberoasting:

Kerberoasting is an incredibly powerful and reliable attack against Active Directory. In some situations it can result in an attacker becoming Domain Admin nearly instantaneously.

Here's how to prevent this attack: 🧵

First we need to identify Active Directory users that are "kerberoastable" - possible targets for the attacker to choose to Kerberoast.

Kerberoast relies on a user having some value in their "serviceprincipalnames" attribute.

Find all of them instantly with no 3rd party tools:

dsquery has been built in to Windows Server since Server 2008. You also get it when installing RSAT.

Here's the command:

dsquery * "dc=contoso,dc=com" -filter "(&(objectcategory=user)(servicePrincipalName=*))" -attr distinguishedName servicePrincipalName

Read 12 tweets

Andy Robbins

@_wald0

Aug 8, 2022

Take a close look at BARK's functions and you will see that most of them are simple wrappers around basic REST API calls. This means it's very easy to extend BARK.

For example, BARK is missing a function to list virtual machines. Here's how easy this is to add: 🧵

Let's look at an existing function that lists objects in AzureRM, "Get-AllAzureRMResourceGroups":

The most "difficult" line we need to change is line 24. We must ensure we are hitting the right URL.

The Microsoft documentation can help us here. We will Google "azure api list virtual machines", and the first result is this page:

docs.microsoft.com/en-us/rest/api…

Read 7 tweets

Share this page!

Andy Robbins

People who liked this thread also liked...

Try unrolling a thread yourself!

More from @_wald0

Andy Robbins

Andy Robbins

Andy Robbins

Andy Robbins

Andy Robbins

Andy Robbins

Did Thread Reader help you today?

Don't want to be a Premium member but still want to support us?

Send Email!