CLOUD POST EXPLOITATION Andrew Johnson @secprez | Sacha Faust - PowerPoint PPT Presentation

CLOUD POST EXPLOITATION Andrew Johnson @secprez | Sacha Faust @sachafaust | Cloud & Enterprise Red T eam

ake Aways Azure Overview Key T Cloud Pivots Trends and Countermeasures 2

eam • Red Team Success Culture – Collective Growth Mindset • C+E Red T “Let’s make it harder!” MTTC + MTTO • Engineering Focused MTTD + MTTR • Diplomatic • Clear rules of engagement • Operate like Next Generation APT™ • P0 focus – break glass scenarios • Cloud vs Cloud • Shift from Operation to Run Adapt Adapt+ Recovery Games Walk Crawl 3

Azure Crash Course

Production Domain Internet SQL Azure Azure VM Azure Network ACL, (IAAS) PAAS Ingress & Egress Azure Storage Service Monitoring Private Network Azure Analytics Azure VNET (Logging) VM VM Azure Redis Cache Application SQL Server Domain Controller Azure Azure File Server Server Key Vault Document DB 5

Cloud Mindset Server Services Domain Subscription Domain Admin Subscription Admin Pass the Hash Credential Pivot Private IPs Public IPs RDP / SSH Management APIs 6

Pivoting

Option 1 – Exfil running VM Basic - Storage to VM Shadow copy VM Start-AzureStorageBlobCopy Option 2 – override VM when turned off Research Area – Tamper running VM 8

PAAS 101 Attacking Hosted Services - PAAS • Hosted Services are created from three elements: Certificates • Certificates hosting in the cloud service • A configuration file containing secrets and other service metadata • A package containing the code and resources Hosted Service Package Configuration (cspkg) (cscfg) 9

RDP Extension Step 1 – Get role configuration Get-AzureDeployment Step 2 – Create Extension New- Remote Desktop AzureServiceRemoteDesktopExtensi onConfig Step 3 – Push tampered package Set-AzureDeployment Step 4 – Remove when done Remove- PAASRemoteAccessExtension 10

Platform As a Service (PAAS) 11

PAAS Certificates Step 1 – Query management API to get Certificates available Get-AzureDeployment Step 2 – Create custom service package • Add target certificate thumbprint • Make service dump certs from OS and exfil Step 3 – Initiate deployment Set-AzureDeployment with Use upgrade flag to staging slot Step 4 – Wait for cert and pivot 12

PAAS Upgrade Step 1 - Exfiltrate cspkg file Get Package Get-AzureBlobContent Step 2 – Find/Create elevated task and bootstrap malware Step 3 – Update file hash Step 4 – Push tampered package Set-AzureBlobContent Step 5 – Initiate deployment Set-AzureDeployment with Use upgrade flag 13

Hybrid Pivot On Premise to Cloud Pivot! 14

Persistence

Persistence - Pyramid • Service Principals support multiple passwords Identity • App provides rich landscape • Subscription administrators Subscription • Management Certificates • Storage Account Key Storage Account • Secure Access Url (SAS) key (offline minting) • Tamper Deployment Cloud Service • OS persistence Virtual • Override Machine • Shadow copy • Add resource to resource group (VM) Network • Modify Network Security Group 17

As an operator/attacker, do you have enough visibility in the risks you are accepting? Indicators of Monitoring (IOM) • Detection (IOD) • Recovery (IOR) •

Rise of Anomaly Detection IOM/D Trends Azure Security Center Anomaly Detection API – Cortana Intelligence Gallery Azure Security Center https://aka.ms/infiltrate2017-anomalyapi “Anomaly Detection is an API built with Azure Machine Learning that is useful for detecting different types of anomalous patterns in your time series data” 20

Purple Teaming – https://aka.ms/scalingredteam IOM/D Trends 21

The commoditization of Threat Intel IOM/D Trends Azure Security Center 22

“Stealth” features in Defense IOM/D Trends DATA PLANE CONTROL PLANE Forensic @Scale Off-Node Analysis VM VHD VHD VHD VHD VHD VHD VHD Azure Storage 23

Trends – Engineering • Monoculture • Shift from cost center to profit • Used to scale - system engineering and data scientist • Used to very high expectation – Azure 99.9% https://www.youtube.com/watch?v=R31Ez1XJEeI

Trends – Engineering Assume Breach mindset

Specific/sequential targeting Sophisticated planning Counter Measures … Effective reconnaissance Social engineering Practiced tool usage Advanced & persistent Varied Persistence Intelligence Driven Diversionary T actics Machine Learning Multi-FrontAssaults Infiltrate 2015 - Data Driven Offence https://vimeo.com/133292422 26

Counter Measures … 27

Thank you Sacha cha Faust ust Andr drew ew Joh ohnson son @sachafaust achafaust @secpr ecprez ez https://aka.ms/cesecurityjobsse