From 7c52cb5d5a0a4a2760683153d91be6d9c5346dc6 Mon Sep 17 00:00:00 2001 From: Translator Date: Tue, 16 Jun 2026 13:29:14 +0000 Subject: [PATCH] Translated ['', 'src/pentesting-cloud/azure-security/az-unauthenticated- --- .../README.md | 207 ++++++++++++++---- 1 file changed, 169 insertions(+), 38 deletions(-) diff --git a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/README.md b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/README.md index f727a0a1e..ff8e6acb9 100644 --- a/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/README.md +++ b/src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/README.md @@ -6,14 +6,14 @@ ### Tenant Enumeration -Kuna baadhi ya **API za Azure za umma** ambazo kwa kujua tu **domain ya tenant** mshambuliaji anaweza kuziuliza ili kupata taarifa zaidi kuhusu hiyo tenant.\ -Unaweza kuuliza API moja kwa moja au kutumia maktaba ya PowerShell [**AADInternals**](https://github.com/Gerenios/AADInternals) (`Install-Module AADInternals`): +Kuna baadhi ya **public Azure APIs** ambazo kwa kujua tu **domain ya tenant** mshambuliaji anaweza kuzitumia kuuliza na kukusanya taarifa zaidi kuihusu.\ +Unaweza kuuliza API moja kwa moja au kutumia PowerShell library [**AADInternals**](https://github.com/Gerenios/AADInternals) (`Install-Module AADInternals`): -- **Taarifa za kuingia zikiwemo tenant ID** +- **Login information including tenant ID** - `Get-AADIntTenantID -Domain ` (main API `login.microsoftonline.com//.well-known/openid-configuration`) -- **Domains zote halali katika tenant** +- **All valid doimains in the tenant** - `Get-AADIntTenantDomains -Domain ` (main API `autodiscover-s.outlook.com/autodiscover/autodiscover.svc`) -- **Taarifa za kuingia za mtumiaji**. Ikiwa `NameSpaceType` ni `Managed`, ina maana EntraID inatumiwa +- **Login information of the user**. If `NameSpaceType` is `Managed`, it means EntraID is used - `Get-AADIntLoginInformation -UserName ` (main API `login.microsoftonline.com/GetUserRealm.srf?login=`) Unaweza kuuliza taarifa zote za Azure tenant kwa **amri moja tu kutoka** [**AADInternals**](https://github.com/Gerenios/AADInternals): @@ -35,27 +35,62 @@ company.mail.onmicrosoft.com True True True Managed company.onmicrosoft.com True True True Managed int.company.com False False False Managed ``` -Inawezekana kuona maelezo kuhusu jina la tenant, ID, na jina la "brand". Zaidi ya hayo, status ya Desktop Single Sign-On (SSO), pia inajulikana kama [**Seamless SSO**](https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso), inaonyeshwa. Inapowezeshwa, kipengele hiki hurahisisha kubaini uwepo (enumeration) wa mtumiaji fulani ndani ya shirika lengwa. +Inawezekana kuona maelezo kuhusu jina la tenant, ID, na jina la "brand". Zaidi ya hayo, hali ya Desktop Single Sign-On (SSO), pia inajulikana kama [**Seamless SSO**](https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso), inaonyeshwa. Ikiawashwa, kipengele hiki hurahisisha kubaini uwepo (enumeration) wa mtumiaji mahususi ndani ya shirika lengwa. -Zaidi ya hayo, output inaonyesha majina ya domains zote zilizo kuthibitishwa zinazohusiana na tenant lengwa, pamoja na aina zao za identity types. Kwa kesi ya domains za federated, Fully Qualified Domain Name (FQDN) ya identity provider inayotumika, kawaida seva ya ADFS, pia ina funuliwa. Safu "MX" inaonyesha kama barua pepe zinapita kwenda Exchange Online, wakati safu "SPF" inaonyesha kuwekwa kwa Exchange Online kama mtumaji wa barua pepe. Ni muhimu kutambua kwamba kazi ya reconnaissance ya sasa haina parse ya statements za "include" ndani ya rekodi za SPF, jambo ambalo linaweza kusababisha false negatives. +Zaidi ya hayo, output inaonyesha majina ya domains zote zilizothibitishwa zinazohusiana na tenant lengwa, pamoja na aina zao za identity husika. Kwa domains zilizo federated, Fully Qualified Domain Name (FQDN) ya identity provider inayotumika, kwa kawaida ADFS server, pia hufichuliwa. Kolamu ya "MX" hubainisha kama emails zinapelekwa kwenda Exchange Online, ilhali kolamu ya "SPF" huonyesha uorodheshaji wa Exchange Online kama mtumaji wa email. Ni muhimu kutambua kuwa function ya sasa ya reconnaissance haichambui kauli za "include" ndani ya SPF records, jambo ambalo linaweza kusababisha false negatives. ### User Enumeration > [!TIP] -> Kumbuka kwamba hata kama tenant inatumia barua pepe nyingi kwa mtumiaji mmoja, **jina la mtumiaji ni la kipekee**. Hii inamaanisha itafanya kazi tu na domain ambayo mtumiaji ameihusisha na sio na domains nyingine. +> Tambua kwamba hata kama tenant anatumia emails kadhaa kwa user yuleyule, **username ni unique**. Hii inamaanisha kuwa itafanya kazi tu na domain ambayo user ameihusisha na si domains nyingine. -Inawezekana **kuangalia kama jina la mtumiaji lipo** ndani ya tenant. Hii pia inajumuisha **watumiaji wageni**, ambao jina lao la mtumiaji lipo kwa muundo: +Inawezekana **kuangalia kama username ipo** ndani ya tenant. Hii pia inahusisha **guest users**, ambao username yao iko katika umbo: ``` #EXT#@.onmicrosoft.com ``` -Barua pepe ni anwani ya mtumiaji ambapo alama “@” imebadilishwa kuwa “\_“. +Barua pepe ni anwani ya barua pepe ya mtumiaji ambapo “@” imebadilishwa na underscore “\_“. -Kwa kutumia [**AADInternals**](https://github.com/Gerenios/AADInternals), unaweza kwa urahisi kuangalia kama mtumiaji yupo au la: +Kwa [**AADInternals**](https://github.com/Gerenios/AADInternals), unaweza kwa urahisi kuangalia kama mtumiaji yupo au la: ```bash # Check does the user exist Invoke-AADIntUserEnumerationAsOutsider -UserName "user@company.com" ``` -I don't have the README.md content to translate. Please paste the file text you want translated to Swahili (I'll preserve all Markdown/html tags, links and code). +# Azure Security: az-unauthenticated-enum-and-initial-entry + +Az-unauthenticated-enum-and-initial-entry ni mbinu inayotumika kufanya enumeration ya Azure bila uthibitishaji na kupata initial entry kwenye mazingira ya Azure. Mbinu hii inaweza kusaidia kutambua resources, permissions, exposures, na huduma ambazo zimeachwa wazi kwa public access au zimenaswa kutokana na misconfigurations. + +Kawaida, hatua za awali hujumuisha kukusanya taarifa kuhusu tenant, subscriptions, storage accounts, Key Vaults, App Services, na endpoints nyingine zinazoonekana hadharani. Hii inaweza kufanywa kupitia public APIs, metadata endpoints, DNS, exposed blobs, na taarifa nyingine zinazopatikana bila kuingia. + +## Common sources for initial enumeration + +- Publicly exposed storage accounts +- Azure App Services with misconfigurations +- Open blobs and containers +- Misconfigured Key Vault access +- Public DNS records and subdomains +- Leaked credentials or tokens +- Publicly accessible management interfaces + +## What to look for + +- Anonymous read access +- Overly permissive roles +- Sensitive data exposure +- Forgotten test or dev resources +- Weakly protected secrets +- Identity and access misconfigurations + +## Typical next steps + +- Enumerate exposed services +- Identify interesting data or credentials +- Validate access boundaries +- Map trust relationships +- Look for paths to initial foothold + +## Notes + +Katika Azure, initial entry mara nyingi hutokana na misconfigurations badala ya vulnerability ya moja kwa moja. Kwa hiyo, kuangalia permissions, access policies, na exposed resources ni muhimu sana. ``` UserName Exists -------- ------ @@ -75,22 +110,22 @@ external.user_outlook.com#EXT#@company.onmicrosoft.com # Invoke user enumeration Get-Content .\users.txt | Invoke-AADIntUserEnumerationAsOutsider -Method Normal ``` -Kwa sasa kuna **mbinu 4 tofauti za enumeration** za kuchagua. Unaweza kupata taarifa katika `Get-Help Invoke-AADIntUserEnumerationAsOutsider`: +Currenlty kuna **mbinu 4 tofauti za enumeration** za kuchagua. Unaweza kupata taarifa katika `Get-Help Invoke-AADIntUserEnumerationAsOutsider`: -Inasaidia mbinu zifuatazo za enumeration: Normal, Login, Autologon, and RST2. +Inasaidia mbinu zifuatazo za enumeration: Normal, Login, Autologon, na RST2. -- Njia ya **Normal** inaonekana kwa sasa inafanya kazi na tenants zote. Hapo awali ilihitaji Desktop SSO (aka Seamless SSO) iwe imewezeshwa kwa angalau domain moja. +- Mbinu ya **Normal** inaonekana sasa inafanya kazi na tenants zote. Hapo awali ilihitaji Desktop SSO (aka Seamless SSO) iwe imewezeshwa kwa angalau domain moja. -- Njia ya **Login** inafanya kazi na tenant yoyote, lakini enumeration queries zitaandikwa kwenye Azure AD sign-in log kama failed login events! +- Mbinu ya **Login** inafanya kazi na tenant yoyote, lakini enumeration queries zitaandikwa kwenye Azure AD sign-in log kama failed login events! -- Njia ya **Autologon** inaonekana haitumii tena na tenants zote. Inawezekana inahitaji DesktopSSO au directory sync iwe imewezeshwa. +- Mbinu ya **Autologon** inaonekana haifanyi kazi tena na tenants zote. Huenda inahitaji DesktopSSO au directory sync iwe imewezeshwa. -Baada ya kugundua valid usernames unaweza kupata **taarifa kuhusu mtumiaji** kwa: +Baada ya kugundua valid usernames unaweza kupata **info about a user** kwa: ```bash Get-AADIntLoginInformation -UserName root@corp.onmicrosoft.com ``` -Skripti [**o365spray**](https://github.com/0xZDH/o365spray) pia inakuwezesha kugundua **ikiwa anwani ya barua pepe ni halali**. +Script [**o365spray**](https://github.com/0xZDH/o365spray) pia pia inakuwezesha kugundua **ikiwa barua pepe ni halali**. ```bash git clone https://github.com/0xZDH/o365spray cd o365spray @@ -103,13 +138,13 @@ python3 ./o365spray.py --enum -d carloshacktricks.onmicrosoft.com -U /tmp/users. ``` **User Enumeration via Microsoft Teams** -Chanzo kizuri kingine cha taarifa ni Microsoft Teams. +Chanzo kingine kizuri cha taarifa ni Microsoft Teams. -API ya Microsoft Teams inaruhusu kutafuta watumiaji. Hasa "user search" endpoints **externalsearchv3** na **searchUsers** zinaweza kutumika kuomba taarifa za jumla kuhusu akaunti za watumiaji waliojisajili kwenye Teams. +API ya Microsoft Teams inaruhusu kutafuta users. Hasa, endpoints za "user search" **externalsearchv3** na **searchUsers** zinaweza kutumika kuomba taarifa za jumla kuhusu accounts za users waliojiandikisha kwenye Teams. -Kulingana na majibu ya API, inawezekana kutofautisha watumiaji wasiopatikana na watumiaji waliopo ambao wana usajili halali wa Teams. +Kulingana na jibu la API inawezekana kutofautisha kati ya users wasioexist na users existo ambao wana valid Teams subscription. -The script [**TeamsEnum**](https://github.com/lucidra-security/TeamsEnum) inaweza kutumika kuhalalisha seti fulani ya majina ya watumiaji dhidi ya Teams API, lakini unahitaji ufikiaji wa mtumiaji mwenye haki za Teams ili kuitumia. +Script [**TeamsEnum**](https://github.com/lucidra-security/TeamsEnum) inaweza kutumika kuthibitisha seti fulani ya usernames dhidi ya API ya Teams, lakini unahitaji access kwa user aliye na Teams access ili kuitumia. ```bash # Install git clone https://github.com/lucidra-security/TeamsEnum @@ -119,13 +154,45 @@ python3 -m pip install -r requirements.txt # Login and ask for password python3 ./TeamsEnum.py -a password -u -f inputlist.txt -o teamsenum-output.json ``` -I don't have the contents of src/pentesting-cloud/azure-security/az-unauthenticated-enum-and-initial-entry/README.md. Please paste the README.md content here (preserve the markdown/links/tags). I will translate the English text to Swahili, leaving code, tags, links, paths and specified terms unchanged. +# Azure Unauthenticated Enum and Initial Entry + +When approaching Azure pentesting, one of the first things to check is whether you can enumerate resources or get an initial foothold without authentication. In some cases, misconfigurations, public exposures, or weak access controls allow attackers to discover valuable information or gain entry into services. + +## Common unauthenticated attack surface + +- Public storage accounts or blobs +- Exposed Azure DevOps artifacts or pipelines +- Misconfigured App Services +- Open management endpoints +- Leaked credentials or tokens in public repos, logs, or configs + +## Useful checks + +- Identify publicly reachable subdomains and services +- Test for anonymous access to storage containers and blobs +- Review response headers and metadata for service-specific clues +- Look for exposed files, backups, and configuration dumps +- Enumerate publicly accessible APIs and endpoints + +## Initial entry opportunities + +If authentication is not required, initial entry may come from: + +- Anonymous read access to sensitive data +- Writable storage or upload points +- Exposed admin or debug interfaces +- Forgotten test environments +- Hardcoded secrets in client-side code or config files + +## Notes + +Always validate exposure carefully and stay within scope. Even a small leak can reveal enough to pivot deeper into the environment. ``` [-] user1@domain - Target user not found. Either the user does not exist, is not Teams-enrolled or is configured to not appear in search results (personal accounts only) [+] user2@domain - User2 | Company (Away, Mobile) [+] user3@domain - User3 | Company (Available, Desktop) ``` -Zaidi ya hayo, inawezekana kuorodhesha taarifa za upatikanaji kuhusu watumiaji waliopo kama zifuatazo: +Zaidi ya hayo inawezekana kufanya enumerate ya taarifa za availability kuhusu users waliopo kama zifuatazo: - Available - Away @@ -133,11 +200,38 @@ Zaidi ya hayo, inawezekana kuorodhesha taarifa za upatikanaji kuhusu watumiaji w - Busy - Offline -Ikiwa **ujumbe wa kutokuwa kazini** umewekwa, pia inawezekana kupata ujumbe huo kwa kutumia TeamsEnum. Ikiwa faili ya pato ilibainishwa, ujumbe za kutokuwa kazini huhifadhiwa moja kwa moja ndani ya faili ya JSON: +Ikiwa **out-of-office message** imewekwa, inawezekana pia kupata message hiyo kwa kutumia TeamsEnum. Ikiwa output file ilibainishwa, out-of-office messages huhifadhiwa kiotomatiki ndani ya faili ya JSON: ``` jq . teamsenum-output.json ``` -Please paste the README.md content you want translated to Swahili. +# Az-Unauthenticated-Enum-And-Initial-Entry + +Katika Azure, unaweza mara nyingi kufanya enumeration ya huduma na resources bila uthibitishaji, na wakati mwingine hii inaweza kutoa initial entry ya kuvutia. Hii inategemea jinsi service inavyowekwa na permissions zilizowekwa vibaya. + +## Mifano ya common unauthenticated enumeration + +- Public blobs na containers +- Exposed storage accounts +- Open Azure App Services +- Misconfigured AKS endpoints +- Public metadata kwenye baadhi ya mazingira + +## Mbinu za kuangalia + +- Jaribu kufikia endpoints za public bila credentials +- Tazama responses zinazofichua taarifa za huduma, names, au versions +- Tafuta directories, files, au config zinazoweza kuwa public +- Thibitisha kama anonymous access imewashwa kwa resources za storage + +## Initial entry + +Wakati unauthenticated enumeration inafichua taarifa muhimu au resources zilizoachwa wazi, inaweza kusaidia kupata foothold ya awali. Hii inaweza kusababisha access zaidi ikiwa kuna secrets, tokens, au public misconfigurations. + +## Vidokezo + +- Angalia kila mara ikiwa kitu ni kweli public au kinahitaji auth baadaye +- Changanya enumeration ya web, storage, na API endpoints +- Tumia taarifa iliyopatikana kutambua attack surface ya ziada ```json { "email": "user2@domain", @@ -192,9 +286,9 @@ Please paste the README.md content you want translated to Swahili. az-password-spraying.md {{#endref}} -## Azure Services zinazotumia vikoa +## Azure Services using domains -Pia inawezekana kujaribu kutafuta **Azure services exposed** katika subdomains za kawaida za azure kama zile zilizoandikwa katika [post: +It's also possible to try to find **Azure services exposed** in common azure subdomains like the ones documented in this [post: ](https://www.netspi.com/blog/technical-blog/cloud-penetration-testing/enumerating-azure-services/) - App Services: `azurewebsites.net` @@ -216,32 +310,69 @@ Pia inawezekana kujaribu kutafuta **Azure services exposed** katika subdomains z - Search Appliance: `search.windows.net` - API Services: `azure-api.net` -Unaweza kutumia njia kutoka kwa [**MicroBust**](https://github.com/NetSPI/MicroBurst) kwa lengo hilo. Kazi hii itatafuta jina la kikoa cha msingi (na mabadiliko machache) katika kadhaa ya **azure domains:** +You can use a method from [**MicroBust**](https://github.com/NetSPI/MicroBurst) for such goal. This function will search the base domain name (and a few permutations) in several **azure domains:** ```bash Import-Module .\MicroBurst\MicroBurst.psm1 -Verbose Invoke-EnumerateAzureSubDomains -Base corp -Verbose ``` ## Phishing -- [**Common Phishing**](https://book.hacktricks.wiki/en/generic-methodologies-and-resources/phishing-methodology/index.html) kwa credentials au kupitia [OAuth Apps](az-oauth-apps-phishing.md) +- [**Common Phishing**](https://book.hacktricks.wiki/en/generic-methodologies-and-resources/phishing-methodology/index.html) for credentials or via [OAuth Apps](az-oauth-apps-phishing.md) - [**Device Code Authentication** Phishing](az-device-code-authentication-phishing.md) +### Exchange Online direct-to-tenant SMTP spoofing + +Ikiwa target inatumia **Exchange Online / EOP** lakini public yake **MX** inaelekeza kwenye **third-party mail gateway** (Mimecast, Proofpoint, Mailgun, on-prem filtering, etc.), test kama Exchange Online bado inakubali mail iliyotumwa **moja kwa moja** kwa tenant host `*.mail.protection.outlook.com`. Katika hali hiyo, attacker anaweza **kuruka external gateway** na kuwasilisha phishing mail moja kwa moja kwa EOP. + +Hii ni muhimu kwa **initial access / phishing** kwa sababu delivery bado inaweza kufanikiwa hata wakati spoofed sender inashindwa **SPF**, **DKIM**, na **DMARC**. Kwa internal senders, Outlook pia inaweza kutatua spoofed sender kama employee halisi, hivyo kuongeza trust. + +**Recon / triage:** +```bash +# If the MX already points to Microsoft, this specific path is usually not the issue +dig +short MX target.com + +# Typical vulnerable pattern: the MX points to a third-party filter +# 10 mxb.eu.mailgun.org. +``` +Mwenyekiti wa EOP wa moja kwa moja kwa kawaida ni jina mahususi la tenant `mail.protection.outlook.com` (kwa mfano `target-com.mail.protection.outlook.com`). Mara nyingi unaweza kurejesha muundo wa majina ya tenant kutoka public tenant/domain enumeration na majibu ya Exchange-related autodiscover. + +**Minimal PoC:** +```powershell +Send-MailMessage -SmtpServer target-com.mail.protection.outlook.com -To victim@target.com -From ceo@target.com -Subject "Urgent" -Body "Review the attached payment change" -BodyAsHTML +``` +**Validation signals:** +- Mail inatumwa kwa `*.mail.protection.outlook.com` badala ya public MX host. +- Message inawasilishwa hata ingawa headers zinaonyesha failures kama `spf=fail`, `dkim=none`, `dmarc=fail`, au `compauth=none`. +- Secure Partner connector kawaida hukataa hatua ya `RCPT TO` kwa `5.7.51 TenantInboundAttribution; Rejecting.` + +**Technical notes / defensive hunting:** +- **Enhanced Filtering for Connectors** husaidia Exchange kuhusisha original sender kwa usahihi, lakini yenyewe si **boundary** inayozuia direct-to-tenant delivery. +- Microsoft inaandika controls mbili za vitendo unapotumia external MX mbele ya Exchange Online: +- Create a **Partner inbound connector** with `SenderDomains *` and `RestrictDomainsToCertificate` or `RestrictDomainsToIPAddresses` so only the approved gateway can deliver to the tenant. +- Create a **priority 0 transport rule** that quarantines inbound mail unless the sender IP belongs to approved gateway ranges **or** `X-MS-Exchange-Organization-AuthAs` contains `Internal`. +- Hunt for mail where **Received** shows `*.mail.protection.outlook.com` as the first Microsoft hop but sender-authentication headers still show **SPF/DKIM/DMARC failures**. +- If the target still allows **Direct Send**, disabling it mainly reduces **internal** sender spoofing; it doesn't replace the connector / transport-rule mitigation for arbitrary **external** spoofing. + ## Filesystem Credentials -**`az cli`** inahifadhi taarifa nyingi za kuvutia ndani ya **`/.Azure`**: -- **`azureProfile.json`** ina taarifa kuhusu watumiaji waliokuwa wameingia hapo awali -- **`clouds.config`** ina taarifa kuhusu subscriptions -- **`service_principal_entries.json`** ina applications **credentials** (tenant id, clients and secret) -- **`msal_token_cache.json`** ina **access tokens and refresh tokens** +The **`az cli`** huhifadhi taarifa nyingi za kuvutia ndani ya **`/.Azure`**: +- **`azureProfile.json`** contains info about logged in users from the past +- **`clouds.config`** contains info about subscriptions +- **`service_principal_entries.json`** contains applications **credentials** (tenant id, clients and secret) +- **`msal_token_cache.json`** contains **access tokens and refresh tokens** -Kumbuka kwamba kwenye macOS na linux faili hizi zimehifadhiwa kwa maandishi wazi na **bila ulinzi**. +Note that in macOS and linux these files are **unprotected** stored in clear text. -## Marejeleo +## References - [https://aadinternals.com/post/just-looking/](https://aadinternals.com/post/just-looking/) - [https://www.securesystems.de/blog/a-fresh-look-at-user-enumeration-in-microsoft-teams/](https://www.securesystems.de/blog/a-fresh-look-at-user-enumeration-in-microsoft-teams/) - [https://www.netspi.com/blog/technical-blog/cloud-penetration-testing/enumerating-azure-services/](https://www.netspi.com/blog/technical-blog/cloud-penetration-testing/enumerating-azure-services/) +- [https://labs.infoguard.ch/posts/ghost-sender/](https://labs.infoguard.ch/posts/ghost-sender/) +- [https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/manage-mail-flow-using-third-party-cloud](https://learn.microsoft.com/en-us/exchange/mail-flow-best-practices/manage-mail-flow-using-third-party-cloud) +- [https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about](https://learn.microsoft.com/en-us/defender-office-365/anti-phishing-policies-about) +- [https://techcommunity.microsoft.com/blog/exchange/direct-send-vs-sending-directly-to-an-exchange-online-tenant/4439865](https://techcommunity.microsoft.com/blog/exchange/direct-send-vs-sending-directly-to-an-exchange-online-tenant/4439865) {{#include ../../../banners/hacktricks-training.md}}