Lateral Movement in Azure App Services

Karl Fosaaen
August 17th, 2020

Lateral Movement in Azure App Services

We test a lot of web applications at NetSPI, and as everyone continues to move their operations into the cloud, we’re running into more instances of applications being run on Azure App Services. Whenever we run into an App Services application with a serious vulnerability, I’ll frequently get a ping asking about next steps to […]

Karl Fosaaen
July 29th, 2020

Get-AzPasswords: Encrypting Automation Password Data

Get-AzPasswords is a function within the MicroBurst toolkit that’s used to get passwords from Azure subscriptions using the Az PowerShell modules. As part of this, the function supports gathering passwords and certificates that are attached to automation accounts. These credentials can be stored in a few different ways: Credentials – Username/Password combinations Connections – Service […]

Karl Fosaaen
July 16th, 2020

Azure File Shares for Pentesters

For many years, pentester-hosted SMB shares have been a common technology to use during internal penetration tests for getting tools over to, and data off of, target systems. The process is simple: share a folder from your testing system, execute a “net use z: \\testingbox\tools” from your target, and run your tools from the share. […]

Karl Fosaaen
April 16th, 2020

Gathering Bearer Tokens from Azure Services

In the previous Azure Managed Identities blog, we covered some simple proof of concept examples for using Azure Virtual Machine Managed Identities to escalate privileges in an Azure subscription. The example code relied on Azure OAuth bearer tokens that were generated from authenticating to the Azure metadata service. Since posting that blog, we’ve found a […]

Scott Sutherland
March 27th, 2020

Linux Hacking Case Studies Part 5: Building a Vulnerable Linux Server

This blog will share how to configure your own vulnerable Linux server so you can practice building and breaking at home.

Scott Sutherland
March 26th, 2020

Linux Hacking Case Studies Part 4: Sudo Horror Stories

This blog will cover different ways to approach SSH password guessing and attacking sudo applications to gain a root shell on a Linux system.

Scott Sutherland
March 25th, 2020

Linux Hacking Case Studies Part 3: phpMyAdmin

This blog will walkthrough how to attack insecure phpMyAdmin configurations and world writable files to gain a root shell on a Linux system.

Scott Sutherland
March 24th, 2020

Linux Hacking Case Studies Part 2: NFS

This blog will walk through how to attack insecure NFS exports and setuid configurations in order to gain a root shell on a Linux system.

Scott Sutherland
March 23rd, 2020

Linux Hacking Case Studies Part 1: Rsync

This blog will walk through how to attack insecure Rsync configurations in order to gain a root shell on a Linux system.