Hi!

Attackers want to target service principals because:

• Service accounts and service principals do not have MFA
• Attackers can log into Azure using a service principal account
• These accounts exist with all applications in Azure (most companies have several) 
• These accounts could be controlled through conditional access only with an Azure Active Directory P2.

Sign-in with the service principal using Azure CLI:

az login –service-principal -u YourServicePrincipald -p YourServicePrincipalPassword -tenant YourTenantId –allow-no-subscriptions

To prevent this attack, you can define a Conditional Access policies for your service principals. You need to have an Azure Active Directory Premium P2 to enable this feature.

• https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/workload-identity
• https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-location

Maxime.

Hi!

Yesterday, I had the privilege to give a talk about an introduction of Azure Pentesting.

Slides (in English)

Video (in French)

Maxime.

Hi!

In this article, I will show you how you can exploit a virtual machine associated with a Managed Identity. To leverage this attack, we will use the LAVA – Azure Exploitation framework.

In the first step, we will execute a command to list all the machines hosted in the Azure subscription. The goal of this action is to identity which machine is configured with a Managed Identity. In the example below, we can see the virtual machine max01 configured with a Managed Identity (SystemAssigned).

In the second step, we can see the virtual machine max01 associated with a privilege role. In this example, the privileged role associated with the identity of the max01 virtual machine is owner of the Azure subscription!

In the third step, we will leverage the « Run Command » feature, to execute a call to the metadata endpoint and retrieve the access token used by the Managed Identity feature. By default all the commands executed with the « Run Command » feature are executed as root!

In the last step of this article, we will use the token retrieved during the third step and usurp the identity of the virtual machine max01 to run a command to list the subscriptions or the ressource groups. With the owner role associated to the managed identity, a malicious attacker could leverage this attack to create, modify or delete any resources hosted in this Azure Subscription.

Maxime.