This post details the existing and new functions in BARK that support adversarial tradecraft research relevant to the Azure Key Vault service. The latter part of the post shows an example of how a red team operator may use these commands during the course of an assessment.
AuthenticationAzure Key Vault is one of the few services in Azure with a dedicated API for data plane operations. When performing calls to the Azure REST API and the Azure Key Vault REST API, you must provide authentication in the form of a bearer token. That token must have the correct audience.
BARK has the following functions for requesting tokens for use with the Azure REST API:
BARK has the following functions for requesting tokens for use with the Azure Key Vault REST API:
BARK has the following function for enumerating key vaults via the Azure REST API:
BARK has the following functions for enumerating key vault items via the Azure Key Vault REST API:
BARK has the following functions for manipulating permissions on key vaults and key vault items via the Azure REST API:
BARK has the following function for collecting key vault secret values via the Azure Key Vault REST API:
BARK has the following functions for encrypting and decrypting data via the Azure Key Vault REST API:
During a red team assessment, the operator may find they have read access into one or more Azure Resource Manager (ARM) subscriptions, giving them the ability to enumerate resources in the subscription(s). The operator wants to find all key vaults under a given subscription.
First they must request a token with ARM REST API as the audience. There are several ways to do this and all depend on what level of access the operator has. We will go with a simple example: the operator has plaintext credentials for a valid user. With those credentials, the operator can use BARK’s Get-AzureRMTokenWithUsernamePassword to request a token:
$ARMToken = (Get-AzureRMTokenWithUsernamePassword `Next, the operator can identify all subscriptions they have read access into with BARK’s Get-AllAzureRMSubscriptions function:
$Subscriptions = Get-AllAzureRMSubscriptions -Token $ARMTokenTo find all key vaults under each subscription, the operator can use PowerShell to loop through each subscription and pass its ID to BARK’s Get-AllAzureRMKeyVaults:
$KeyVaults = $Subscriptions | %{Now the operator can attempt to enumerate secrets, keys, and certificates under each key vault; however, the Azure Key Vault REST API serves these operations, so they must first get a token with the correct audience. They can do that with BARK’s Get-AzureKeyVaultTokenWithUsernamePassword:
$KeyVaultToken = (Get-AzureKeyVaultTokenWithUsernamePassword `Now the operator can use that token in conjunction with BARK’s key vault item enumeration functions to list those items under each key vault:
$KeyVaultSecrets = $KeyVaults | %{An example of what these variables look like from our research environment:
PS /> $KeyVaultSecretsThe operator can attempt to read the value of a secret using BARK:
Get-AzureRMKeyVaultSecretValue `Here is an example of what the output looks like from our research environment:
PS /Users/andyrobbins/Documents/SpecterOps/BHE/bloodhound-enterprise> Get-AzureRMKeyVaultSecretValue `In the above example, “secret1value” is the plaintext value of the secret.
The operator can also attempt to encrypt data using the key vault keys with BARK:
Protect-StringWithAzureKeyVaultKey `An example of the command running and its output:
PS /> Protect-StringWithAzureKeyVaultKey `The operator can also decrypt this data or any other data encrypted using this particular key:
Unprotect-StringWithAzureKeyVaultKey `An example of the command running and its output:
PS /> Unprotect-StringWithAzureKeyVaultKey `Key Vault certificates store their public portion within the certificate object and their private portion within a secret. The operator can correlate the certificate and secret identifiers to identify certificate private keys:
PS /> $KeyVaultCertificatesOnce identified, the operator can attempt to extract the certificate’s private key with BARK’s Get-AzureRMKeyVaultSecretValue:
Get-AzureRMKeyVaultSecretValue `An example of the command running and its output:
PS /> Get-AzureRMKeyVaultSecretValue ` >> -KeyVaultSecretID 'https://keyvaultazurerbac.vault.azure.net/secrets/MyCertificate' `We use these commands primarily to validate Microsoft’s documentation on how these APIs function, in particular how ARM and Azure Key Vault APIs make authorization decisions. Defenders can use and build upon these functions to automate key vault inventory and audit processes. Professional red team operators can use and build upon these functions to perform authorized assessment-related actions like reconnaissance, credential access, and payload encryption and decryption.
Azure Key Vault Tradecraft with BARK was originally published in Posts By SpecterOps Team Members on Medium, where people are continuing the conversation by highlighting and responding to this story.
The post Azure Key Vault Tradecraft with BARK appeared first on Security Boulevard.