BadZure

BadZure is a Python tool that utilizes Terraform to automate the setup of Azure Active Directory (now Entra ID) tenants and Azure cloud resrouces, populating them with various entities and introducing common security misconfigurations to create vulnerable tenants with multiple attack paths.

BadZure automates the creation of various entities, including users, groups, application registrations, service principals, administrative units, and Azure resources such as Key Vaults, Storage Accounts, Virtual Machines, and Resource Groups. To simulate common security misconfigurations in real environments, it randomly assigns Azure AD roles, Graph permissions, and application ownership privileges, and Azure resource access permissions to selected security principals, enabling the creation of unique attack paths that span both identity and infrastructure layers. Adhering to the 'Assume Breach' principle, BadZure offers users multiple methods of initial access and three distinct privilege escalation techniques: ServicePrincipalAbuse, KeyVaultAbuse, and StorageAccountAbuse, thereby simulating comprehensive account takeover and cloud resource compromise scenarios.

The key advantage of BadZure is its ability to quickly populate and purge both Azure AD tenants and Azure subscriptions with randomly generated vulnerable configurations, pre-configured initial access, and realistic cloud infrastructure attack paths, facilitating continuous and iterative Azure cloud adversary simulation and detection development experimentation. It is designed for security practitioners interested in exploring and understanding Entra ID and Azure security, cloud resource misconfigurations, and modern cloud-native attack techniques including certificate-based authentication abuse and managed identity privilege escalation.

Goals / Use Cases

BadZure was initialy written to host the Azure AD Battle School: Hands-on Attack and Defense workshop at X33fcon 2023.

An Azure environment populated with BadZure now enables red and blue teams to:

• Experiment with common Entra ID attack vectors and modern cloud infrastructure attack techniques
• Quickly stand up misconfigured Azure tenants with vulnerable cloud resources
• Obtain comprehensive attack telemetry across identity and infrastructure layers to build, test and enhance detection controls
• Execute purple team exercises covering both traditional identity attacks and cloud-native compromise scenarios in a safe setting
• Facilitate hands-on Entra ID and cloud security training with realistic attack paths
• Host dynamic Azure cloud security Capture the Flag (CTF) events with multi-vector attack scenarios

Attack Paths

Initial Access

BadZure simulates initial access by employing common account takeover techniques, including password attacks and token theft. By providing both passwords and tokens, BadZure enables security practitioners to effectively simulate initial access scenarios and explore various attack vectors against Azure AD tenants.

Password-Based Access

When configured to use passwords, BadZure assigns randomly generated passwords to key user accounts that are part of the attack paths. These passwords are provided to BadZure users to simulate password-based attacks, such as credential stuffing or password spraying. Additionally, BadZure automatically generates a users.txt file containing the usernames of all created accounts, facilitating testing strategies like password spraying.

Token-Based Access

For token-based access, BadZure generates JWT access tokens for specified principals. These tokens are provided in the output, simulating scenarios where an attacker has obtained valid tokens through reverse proxy phishing, endpoint malware or device code phishing. Users can utilize these tokens to authenticate directly against Azure AD resources, gaining an understanding of potential attack vectors involving token theft.

Privilege Escalation

BadZure supports three distinct privilege escalation attack paths that introduce realistic misconfigurations across both Azure AD identity and Azure cloud infrastructure layers:

• ServicePrincipalAbuse: Traditional service principal privilege escalation through Azure AD role and Graph API permission misconfigurations
• KeyVaultAbuse: Cloud-native privilege escalation through Azure Key Vault access misconfigurations and secret retrieval
• StorageAccountAbuse: Certificate-based privilege escalation through Azure Storage Account misconfigurations and authentication material theft

Each attack path supports multiple principal types (users, service principals, managed identities) and can be configured with specific or random role assignments. For detailed configuration options and attack path descriptions, refer to the project Wiki.

A BloodHound-generated graph, showcasing the attack paths BadZure can create, is shown below.

Demo

Quick Start Guide

Requirements

• Azure CLI: Follow the instructions here to install Azure CLI.
• Terraform: Follow the instructions here to install Terraform.

Create an Azure AD Tenant

Creating an Azure subscription will also provide you an Azure AD tenant.

Note: Utilizing BadZure within your Azure subscription won't lead to any additional costs as it only requires an Azure AD Free license.

Clone Repository

git clone https://github.com/mvelazc0/BadZure
cd BadZure

Create virtual environment and install dependencies

# Create a virtual environment
python -m venv venv

# Activate the virtual environment
# On Windows
venv\Scripts\activate

# On Unix or MacOS
source venv/bin/activate

# Install dependencies
pip install -r requirements.txt

Login to Azure as a Global Administrator

az login

Create and destroy vulnerable tenants

# Display the help menu
python badzure.py --help

# Populate a tenant and configure all attack paths using the default badzure.yml config file
python badzure.py build

# Populate a tenant and configure all attack paths with a different config file
python badzure.py build --config config.yml

# Show the created resources in Azure AD tenant 
python badzure.py show

# Destroy all created identities with verbose logging
python badzure.py destroy --verbose

YAML Configuration File

BadZure leverages a configuration file used to configure the setup of the Azure AD tenant. This file allows users to specify details such as the number of users, groups, applications, administrative units, and attack paths to be created.

Example Configuration

tenant:
  tenant_id: "your-tenant-id"
  domain: "your-domain.com"
  users: 30
  groups: 10
  applications: 10
  administrative_units: 10

attack_paths:

  attack_path_1:
    enabled: true
    initial_access: password 
    privilege_escalation: ServicePrincipalAbuse
    method: AzureADRole
    entra_role : random

  attack_path_2:
    enabled: true
    initial_access: token
    privilege_escalation: ServicePrincipalAbuse
    method: GraphAPIPermission
    app_role : random 

For more details on the configuration options, please refer to the Wiki

Author

• Mauricio Velazco - @mvelazco

Contributors

• Chan Huan Jun

References

• Cloud Katana by Roberto Rodriguez
• AADInternals by Nestori Syynimaa
• Azure Attack Paths by Fabian Bader
• ROADtools by Dirkjan Mollema
• PurpleCloud by Jason Ostrom
• Azure AD - Attack and Defense Playbook by Sami Lamppu and Thomas Naunheim
• BloodHound/AzureHound by Andy Robbins
• Blog posts, talks and tools by @Haus3c, @kfosaaen, @inversecos and others.

License

This project is licensed under the Apache 2.0 License - see the LICENSE file for details