In this article, we will explore the PwnedLabs Free Azure Blob Container as a potential vector for initial access. Our focus will be on identifying and leveraging any exposed blob storage that could provide a pathway to obtaining user-level access for the Megabigtech platform. We will analyze the configuration and security settings of the Azure Blob storage, evaluate the risks associated with its exposure, and discuss techniques for exploiting these vulnerabilities to gain unauthorized access. Join us as we delve into the methodologies and implications of such an approach in the realm of cloud security.
http://dev.megabigtech.com/$web/index.html
We attempted to use the MicroBurst to enumerate the blob, but we didn’t get any results, so now we are proceeding manually.
?restype=container&comp=list
https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list
Upon investigation, we discovered that only the static CSS and HTML files were available for the hosted website. Unfortunately, there wasn’t anything particularly engaging or noteworthy within the files.
?restype=container&comp=list&include=versions
https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list&include=versions
Although our previous attempts have not been entirely successful, we decided to utilize the terminal to incorporate the ‘x-ms-version’ header, specifically set to the date 2019-12-12, as outlined in the Microsoft documentation. By doing this, we finally managed to successfully access the ‘scripts-transfer.zip’ file.
https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list&include=versions
curl -H "x-ms-version: 2019-12-12" 'https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list&include=versions'
I attempted to download the file using my browser, but unfortunately, that method wasn't successful. As a result, we decided to revert back to using the terminal for the download process. This time, we made sure to include the 'x-ms-version' as a header to ensure compatibility with the server's requirements.
curl -H "x-ms-version: 2019-12-12" 'https://mbtwebsite.blob.core.windows.net/$web/scripts-transfer.zip?versionId=2024-03-29T20:55:40.8265593Z' --output scripts-transfer.zip
The zip file contained two PowerShell scripts that include credentials for the Azure portal.
unzip scripts-transfer.zip
We use the cat command to list the contents of two files. However, entra_users.ps1 contains clear text credentials, and running this script would allow us to list all user information.
cat entra_users.ps1
Before running the script, we need to install the required modules, which are listed at the beginning of the script. Running the script will provide us with a flag that can be found under the job title in one of the user information sections.
Install-Module -Name Az
Install-Module -Name MSAL.PS
.\entra_users.ps1
