diff --git a/src/pentesting-cloud/azure-security/az-device-registration.md b/src/pentesting-cloud/azure-security/az-device-registration.md index 96ca580cf..863ebff29 100644 --- a/src/pentesting-cloud/azure-security/az-device-registration.md +++ b/src/pentesting-cloud/azure-security/az-device-registration.md @@ -1,41 +1,41 @@ -# Az - Device Registration +# Az - Usajili wa Kifaa {{#include ../../banners/hacktricks-training.md}} -## Basic Information +## Taarifa za Msingi -Wakati kifaa kinajiunga na AzureAD, kitu kipya kinaundwa katika AzureAD. +Wakati kifaa kinapojiunga na AzureAD, object mpya huundwa kwenye AzureAD. -Wakati wa kujiandikisha kifaa, **mtumiaji anaombwa kuingia na akaunti yake** (akiulizwa kwa MFA ikiwa inahitajika), kisha inahitaji tokeni za huduma ya usajili wa kifaa na kisha inaomba uthibitisho wa mwisho. +Wakati wa kusajili kifaa, **mtumiaji anaombwa kuingia kwa akaunti yake** (ikiomba MFA ikiwa inahitajika), kisha inakuomba tokeni kwa huduma ya usajili wa kifaa na kisha inaomba uthibitisho wa mwisho. -Kisha, jozi mbili za funguo za RSA zinaundwa katika kifaa: **funguo ya kifaa** (**funguo ya umma**) ambayo inatumwa kwa **AzureAD** na **funguo ya usafirishaji** (**funguo ya faragha**) ambayo inahifadhiwa katika TPM ikiwa inawezekana. +Kisha, jozi mbili za funguo za RSA zinaundwa kwenye kifaa: **device key** (**public** key) ambayo hutumwa kwa **AzureAD** na **transport** key (**private** key) ambayo huhifadhiwa kwenye TPM ikiwa inawezekana. -Kisha, **kitu** kinaundwa katika **AzureAD** (sio katika Intune) na AzureAD inarudisha kwa kifaa **cheti** kilichosainiwa na hiyo. Unaweza kuthibitisha kuwa **kifaa kimejiunga na AzureAD** na taarifa kuhusu **cheti** (kama ikiwa inalindwa na TPM). +Kisha, **object** huundwa katika **AzureAD** (not in Intune) na AzureAD inarudisha kwa kifaa **certificate** iliyosainiwa nayo. Unaweza kuthibitisha kwamba **device is AzureAD joined** na kupata taarifa kuhusu **certificate** (kama ikiwa inalindwa na TPM).: ```bash dsregcmd /status ``` -Baada ya usajili wa kifaa, **Primary Refresh Token** inahitajika na moduli ya LSASS CloudAP na inatolewa kwa kifaa. PRT inakuja na **funguo ya kikao iliyosimbwa ili kifaa pekee kiweze kuifungua** (kwa kutumia funguo ya umma ya funguo ya usafirishaji) na **inahitajika ili kutumia PRT.** +Baada ya usajili wa kifaa, **Primary Refresh Token** inatolewa na moduli ya LSASS CloudAP na kutolewa kwa kifaa. Pamoja na PRT pia hutolewa **kifunguo cha kikao kilichofichwa ili ni kifaa pekee kinaweza kukiweka wazi** (using the public key of the transport key) na kinahitajika **kutumia PRT.** -Kwa maelezo zaidi kuhusu nini PRT ni angalia: +For more information about what is a PRT check: {{#ref}} az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md {{#endref}} -### TPM - Moduli ya Jukwaa Iliyotegemewa +### TPM - Trusted Platform Module -**TPM** **inalinda** dhidi ya **uchimbaji** wa funguo kutoka kwa kifaa kilichozimwa (ikiwa kinalindwa na PIN) na kutoka kwa kuchimba nyenzo za faragha kutoka kwa safu ya OS.\ -Lakini **haiwezi kulinda** dhidi ya **kuangalia** muunganisho wa kimwili kati ya TPM na CPU au **kutumia nyenzo za kifahari** katika TPM wakati mfumo unafanya kazi kutoka kwa mchakato wenye haki za **SYSTEM**. +The **TPM** **protects** against key **extraction** from a powered down device (if protected by PIN) nd from extracting the private material from the OS layer. +But it **doesn't protect** against **sniffing** the physical connection between the TPM and CPU or **using the cryptograpic material** in the TPM while the system is running from a process with **SYSTEM** rights. -Ikiwa utaangalia ukurasa ufuatao utaona kwamba **kuiba PRT** kunaweza kutumika kupata kama **mtumiaji**, ambayo ni nzuri kwa sababu **PRT iko kwenye vifaa**, hivyo inaweza kuibiwa kutoka kwao (au ikiwa haijaibiwa inaweza kutumika vibaya kuunda funguo mpya za kusaini): +If you check the following page you will see that **stealing the PRT** can be used to access like a the **user**, which is great because the **PRT is located devices**, so it can be stolen from them (or if not stolen abused to generate new signing keys): {{#ref}} az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md {{#endref}} -## Kusajili kifaa na tokeni za SSO +## Registering a device with SSO tokens -Ingewezekana kwa mshambuliaji kuomba tokeni kwa huduma ya usajili wa kifaa ya Microsoft kutoka kwa kifaa kilichovunjwa na kukisajili: +Ingekuwa inawezekana kwa mshambuliaji kuomba token kwa Microsoft device registration service kutoka kwa kifaa kilichoathirika na kukisajili: ```bash # Initialize SSO flow roadrecon auth prt-init @@ -47,46 +47,46 @@ roadrecon auth -r 01cb2876-7ebd-4aa4-9cc9-d28bd4d359a9 --prt-cookie # Custom pyhton script to register a device (check roadtx) registerdevice.py ``` -Ambayo itakupa **cheti ambacho unaweza kutumia kuomba PRTs katika siku zijazo**. Hivyo kudumisha uthibitisho na **kuzidi MFA** kwa sababu token ya PRT ya awali iliyotumika kujiandikisha kifaa kipya **ilikuwa tayari na ruhusa za MFA zilizotolewa**. +Which will give you a **certificate you can use to ask for PRTs in the future**. Therefore maintaining persistence and **bypassing MFA** because the original PRT token used to register the new device **already had MFA permissions granted**. > [!TIP] -> Kumbuka kwamba ili kufanya shambulio hili utahitaji ruhusa za **kujiandikisha vifaa vipya**. Pia, kujiandikisha kifaa hakumaanishi kifaa kitakuwa **kimekubaliwa kujiunga na Intune**. +> Note that to perform this attack you will need permissions to **register new devices**. Also, registering a device doesn't mean the device will be **allowed to enrol into Intune**. > [!CAUTION] -> Shambulio hili lilirekebishwa mnamo Septemba 2021 kwani huwezi tena kujiandikisha vifaa vipya kwa kutumia token za SSO. Hata hivyo, bado inawezekana kujiandikisha vifaa kwa njia halali (ikiwa na jina la mtumiaji, nenosiri na MFA ikiwa inahitajika). Angalia: [**roadtx**](https://github.com/carlospolop/hacktricks-cloud/blob/master/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-roadtx-authentication.md). +> This attack was fixed in September 2021 as you can no longer register new devices using a SSO tokens. However, it's still possible to register devices in a legit way (having username, password and MFA if needed). Check: [**roadtx**](https://github.com/carlospolop/hacktricks-cloud/blob/master/pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-roadtx-authentication.md). -## Kuandika upya tiketi ya kifaa +## Overwriting a device ticket -Ilikuwa inawezekana **kuomba tiketi ya kifaa**, **kuandika upya** ile ya sasa ya kifaa, na wakati wa mchakato **kuiiba PRT** (hivyo hakuna haja ya kuiba kutoka kwa TPM. Kwa maelezo zaidi [**angalia mazungumzo haya**](https://youtu.be/BduCn8cLV1A). +Ilikuwa inawezekana **kuomba tiketi ya kifaa**, **kuandika upya** ile ya sasa ya kifaa, na katika mchakato **kuiba the PRT** (hivyo hakuna haja ya kuiba kutoka TPM). For more info [**check this talk**](https://youtu.be/BduCn8cLV1A).
> [!CAUTION] -> Hata hivyo, hili lilirekebishwa. +> However, this was fixed. -## Andika upya funguo za WHFB +## Overwrite WHFB key -[**Angalia slaidi za asili hapa**](https://dirkjanm.io/assets/raw/Windows%20Hello%20from%20the%20other%20side_nsec_v1.0.pdf) +[**Check the original slides here**](https://dirkjanm.io/assets/raw/Windows%20Hello%20from%20the%20other%20side_nsec_v1.0.pdf) Muhtasari wa shambulio: -- Inawezekana **kuandika upya** funguo za **WHFB** zilizoregistriwa kutoka kwa **kifaa** kupitia SSO -- In **shinda ulinzi wa TPM** kwani funguo hiyo **inasomwa wakati wa uzalishaji** wa funguo mpya -- Hii pia inatoa **uthibitisho** +- Inawezekana **kuandika upya** funguo ya **WHFB iliyosajiliwa** kutoka kwa **kifaa** kupitia SSO +- Inavunja **TPM protection** kwani funguo inasniffed during the generation ya funguo mpya +- Hii pia hutoa **persistence**
-Watumiaji wanaweza kubadilisha mali yao ya searchableDeviceKey kupitia Azure AD Graph, hata hivyo, mshambuliaji anahitaji kuwa na kifaa katika tenant (kilichosajiliwa kwa haraka au akiwa na cheti + funguo iliyoporwa kutoka kifaa halali) na token ya ufikiaji halali kwa AAD Graph. +Watumiaji wanaweza kubadilisha property yao searchableDeviceKey via the Azure AD Graph, hata hivyo mshambuliaji anahitaji kuwa na kifaa katika tenant (kimesajiliwa on the fly au akiwa ameiba cert + key kutoka kwa kifaa cha legit) na a valid access token kwa AAD Graph. -Kisha, inawezekana kuzalisha funguo mpya kwa: +Then, it's possible to generate a new key with: ```bash roadtx genhellokey -d -k tempkey.key ``` -na kisha PATCH taarifa za searchableDeviceKey: +kisha PATCH taarifa za searchableDeviceKey:
-Inawezekana kupata token ya ufikiaji kutoka kwa mtumiaji kupitia **device code phishing** na kutumia hatua za awali ili **kuiba ufikiaji wake**. Kwa maelezo zaidi angalia: +Inawezekana kupata access token kutoka kwa mtumiaji kupitia **device code phishing** na kutumia vibaya hatua zilizo hapo awali ili **kumiba ufikiaji wake**. Kwa habari zaidi angalia: {{#ref}} az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md @@ -94,7 +94,7 @@ az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md
-## Marejeleo +## Marejeo - [https://youtu.be/BduCn8cLV1A](https://youtu.be/BduCn8cLV1A) - [https://www.youtube.com/watch?v=x609c-MUZ_g](https://www.youtube.com/watch?v=x609c-MUZ_g)