Advanced Attack Vectors in Azure Environments
summary
Shows concrete escalations: using az CLI and Microsoft Graph REST calls to find an app owner, reset its secret, and authenticate as the app; creating a publishing user via Kudu SCM to run PowerShell that acquires a token for a user-assigned managed identity, then reading a storage blob and pulling a Key Vault secret to decrypt a protected ZIP — demo succeeds. A second chain modifies SCM IP restrictions, abuses AD Connect pass-through agent (DLL injection in demo) to bypass auth and elevate a synced user to global admin. Tooling and blog (10 techniques) and XM-GOAT lab are provided.
AI-written summary · about
chapters (9)
- 0:00Introduction and speakers
- 1:05Agenda overview
- 1:44Azure fundamentals
- 7:34Initial foothold methods
- 10:20AD Connect authentication
- 12:11Use case one: sensitive data
- 25:20Use case two: tenant takeover
- 41:43Security best practices
- 46:21Conclusion and Q&A
related talks
55mOffensive Azure Security
58mPrivilege Escalation in Microsoft Azure
55mAzure Attacks Unpacked: Real-World Threats & Lessons
38mAll You Need is Guest
48mLateral Movement in the Age of Hybrid Cloud
40mWhat’s Old is New: Hybrid Security for Microsoft Azure and On-Premises Tech
47mAzure Vulnerability Testbed (AzGOAT)
38mAbusing Azure Active Directory: From MFA Bypass to Listing Global Administrators