I Hacked The Cloud: Azure Managed Identities
Source: YouTube · John Hammond · published Apr 11, 2024 · 29:31
This video demonstrates compromising an Azure website through a file upload vulnerability, escalating privileges to access a managed identity token, and ultimately gaining control of a virtual machine to extract credentials 0:00-0:12.
Key Takeaways:
• The attacker exploits a PHP file upload restriction by using a .phtml extension to upload a webshell, gaining code execution on the Azure web app 2:51-3:31.
• Environment variables reveal an identity header and identity endpoint, which are used to craft a curl request that obtains an access token for the managed identity 4:56-8:13.
• With the access token, they connect to Azure via PowerShell and discover virtual machines in the subscription, including one with "run command" permissions 17:04-18:55.
• The attacker creates a backdoor administrator account by executing PowerShell on the target VM using Azure's "run command" functionality 22:06-25:11.
• After gaining access to the VM, they find credentials stored in the PowerShell history of a privileged user 26:01-29:03.
This demonstration highlights how a simple web application vulnerability can lead to complete compromise of Azure infrastructure when managed identities are misconfigured 28:23-28:30.
Sources:
- 0:00-0:12 Overview of the attack plan against Azure infrastructure
- 2:51-3:31 Uploading and executing a webshell with .phtml extension
- 4:56-8:13 Extracting environment variables and obtaining managed identity access token
- 17:04-18:55 Discovering VMs with run command permissions in Azure
- 22:06-25:11 Creating and executing a backdoor user script via Azure VM run command
- 26:01-29:03 Extracting credentials from Pow
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cloud Security. Commonly maps to: Security Architecture and Engineering, Communication and Network Security. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
in this video we're going to compromise an Azure website gain access to an access token for a managed identity for the web app and then run code on that virtual machine as system and extract credentials from the VM let's dive in so here I am on my Windows 10 computer and I'm going to open up my web browser Google Chrome where I have this page open for defc corpcare careers. azurewebsites.net this is an Azure website and interestingly enough it has a vulnerability now for the sake of demonstrating a lot of these Azure active directory attacks not going to focus a whole lot on the vulnerability for this web app but note hey it asks us to send us your resume where you can enter your name an email address and then only some Doc X Files or PDF files that you could upload granted it actually wil…