AzureGoat : A Damn Vulnerable Azure Infrastructure

Jeswin Mathai, Nishant Sharma, Sherin Stephen, Rachana Umaraniya

#BHUSA @BlackHatEvents
 About US
Jeswin Mathai
• Chief Architect, Lab Platform @ INE
• Published Research at Black Hat US/Asia Arsenal, DEF CON USA/China Demolabs
• Gave research talk at DEF CON China and Rootcon Philippines
• Co-Trainer in Training:
- Black Hat Asia
- HITB AMS, GSEC
- NZ OWASP day
- Rootcon 13

#BHUSA @BlackHatEvents
Information Classification: General
 About US
Nishant Sharma
• Director, Lab Platform @ INE
• Firmware developer, Enterprise WiFi APs and WIPS Sensors, Mojo Networks (Acquired
by Arista Networks)
• Masters degree in Infosec
• Published research at Blackhat US/Asia, DEF CON USA/China, HITB Amsterdam and
other venues
• Conducted trainings in HITB, OWASP NZ day and for multiple private clients

#BHUSA @BlackHatEvents
Information Classification: General
 About US
Sherin Stephen
• Cloud Developer @ INE
• Presented his work at BlackHat Asia Arsenal 2022
• Experienced in Building and maintaining reusable code and robust cloud services

Rachana Umaraniya
• Cloud Developer @ INE
• Master's Degree in Computer Science
• Two years of experience in software development and specializes in Java Frameworks

#BHUSA @BlackHatEvents
Information Classification: General
 #BHUSA @BlackHatEvents
Information Classification: General
 #BHUSA @BlackHatEvents
Information Classification: General
 Threatscape

#BHUSA @BlackHatEvents
Information Classification: General
 Threatscape

#BHUSA @BlackHatEvents
Information Classification: General
 Motivation
• Training Needs

• Lack of Real World Azure Pentesting Environment

• Contribution from the open source community and security professionals

• Release of OWASP Top 10: 2021

#BHUSA @BlackHatEvents
Information Classification: General
 Introducing AzureGoat

#BHUSA @BlackHatEvents
Information Classification: General
 AzureGoat : A Damn Vulnerable Azure Infrastructure

• Mimics real-world infrastructure but with added vulnerabilities

• Multiple application stacks - Multiple exploitation/escalation paths

• Features OWASP Top 10: 2021

• Focused on Black-box approach

• Still in early stage

- Module 1 : Blog Application

#BHUSA @BlackHatEvents
Information Classification: General
 OWASP Top 10

Image Reference: https://owasp.org/www-project-top-ten/

#BHUSA @BlackHatEvents
Information Classification: General
 AzureGoat : Module 1 (Blog Application)
• A01: Broken Access Control

• A02: Cryptographic Failure

• A03: Injection

• A04: Insecure Design

• A05: Security Misconfiguration

• A07: Identification and Authentication Failures

• A10: Server Side Request Forgery

#BHUSA @BlackHatEvents
Information Classification: General
 AzureGoat : Module 1 (Blog Application)

#BHUSA @BlackHatEvents
Information Classification: General
 Building Realistic Insecure Application : Challenges

• Security Professional vs Seasoned Developers

• Mimicking Development Process

• Multiple Developer Environments

• Fast-paced development

• Lack of secure code practices

#BHUSA @BlackHatEvents
Information Classification: General
 Project Family

#BHUSA @BlackHatEvents
Information Classification: General
 Installation
• Repository: https://github.com/ine-labs/AzureGoat

• Requirements
- AZ Utility
- Terraform
- Python
- Git
• Commands
- az login
- git clone https://github.com/ine-labs/AzureGoat
- terraform init
- terraform apply

#BHUSA @BlackHatEvents
Information Classification: General
 Installation

#BHUSA @BlackHatEvents
Information Classification: General
 Attacking the Application
• Reflected XSS
• SQL Injection
• Insecure Direct Object Reference
• Server Side Request Forgery Click
Clickto
toadd
add
DALL-E
• Sensitive Data Exposure text
text
DALL-E

• Password Reset
• S3 Misconfiguration
• IAM Privilege Escalation

#BHUSA @BlackHatEvents
Information Classification: General
 Exploitation

#BHUSA @BlackHatEvents
Information Classification: General
 Server Side Request Forgery
• Reading the source code of the application

• Reading the environment variables

- Storage Account Credential StringsClick to add
- CosmosDB Credentials. Click DALL-E
to add
- Escalate Privileges text
text
DALL-E

• Enumerate other applications/instances in the network

#BHUSA @BlackHatEvents
Information Classification: General
 Hunting Storage Accounts and Containers
• Globally unique

• Company-wide naming practices: Predictable names - based on departments/applications

Click
Clickto
toadd
add
DALL-E
• text DALL-E
text of information
Misconfigured Storage Account - plethora

#BHUSA @BlackHatEvents
Information Classification: General
 Privilege Escalation

#BHUSA @BlackHatEvents
Information Classification: General
 Future Plans: Multiple Applications across Multiple Tenants

Click DALL-E
to add
DALL-E
text

Image Reference: Architecting multitenant solutions on Azure

#BHUSA @BlackHatEvents
Information Classification: General
 Future Plans
• More modules: Virtual Machine, Container Instances and AKS

• Multi Tenant infrastructure

Click
Clickto
toadd
add
DALL-E
• Working with the community text
text
DALL-E

• IaC Misconfigurations

• Secure coding/deployment practices

#BHUSA @BlackHatEvents
Information Classification: General
 Thanks
Click
Clickto
toadd
add
DALL-E
text
text
DALL-E

[email protected]

#BHUSA @BlackHatEvents
Information Classification: General