Belajar Red Team Operator - Cloud & Hybrid Attack Chains

#Pendahuluan

Setelah di episode 7 kita mempelajari AD attack chains — Kerberos, ADCS, GPO exploitation — pada episode ini kita expand ke cloud & hybrid environments: AWS, Azure, dan hybrid attack chains yang menghubungkan on-premise AD dengan cloud identity.

Di tahun 2026, organisasi tidak lagi sepenuhnya on-premise — mereka hybrid atau cloud-first. Red team harus bisa bergerak dari on-premise ke cloud dan sebaliknya, mengeksploitasi trust relationships antara identity providers.

#AWS Attack Chains

#IAM Privilege Escalation

text

AWS Privilege Escalation Paths
================================
1. iam:PassRole + lambda:CreateFunction
   → Create Lambda dengan IAM role tinggi
 
2. iam:PassRole + ec2:RunInstance
   → Launch EC2 dengan IAM role tinggi
 
3. iam:PassRole + glue:CreateDevEndpoint
   → Create Glue DevEndpoint dengan role tinggi
 
4. iam:PassRole + datapipeline:CreatePipeline
   → Execute activities dengan role tinggi

#Metadata Service Abuse

bash

# IMDSv1 (default, vulnerable)
curl http://169.254.169.254/latest/meta-data/iam/security-credentials/
 
# IMDSv2 (requires token)
TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" \
  -H "X-aws-ec2-metadata-token-ttl-seconds: 21600")
curl -H "X-aws-ec2-metadata-token: $TOKEN" \
  http://169.254.169.254/latest/meta-data/iam/security-credentials/

#SSRF → AWS Credentials

text

SSRF → AWS Chain
==================
1. Find SSRF vulnerability
2. Access metadata service (169.254.169.254)
3. Obtain IAM role credentials
4. Use credentials untuk akses S3, Lambda, etc.
5. Escalate privileges → full AWS account

#Azure / Azure AD Attacks

#Managed Identity Abuse

bash

# Token dari managed identity
curl -H "Metadata: true" \
  "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"
 
# Use token
curl -H "Authorization: Bearer $TOKEN" \
  "https://management.azure.com/subscriptions?api-version=2020-01-01"

#Azure AD — Token Theft

text

Azure Token Attack
====================
1. Compromise device (hybrid-joined)
2. Access token cache (DPAPI)
3. Steal Primary Refresh Token (PRT)
4. Use PRT → Azure AD → cloud resources

#AADConnect Abuse

text

AADConnect Server
===================
- Contains synced credentials
- Has AAD admin permissions
- On-premise AD ↔ Azure AD sync
 
If compromised:
→ Extract all synced credentials
→ Access Azure AD as any user

#Hybrid Attack Chains

#On-Prem → Cloud Chain

text

On-Prem to Cloud Attack Chain
================================
1. Compromise on-premise AD
   → Domain Admin
 
2. Access AADConnect server
   → Extract synced credentials
 
3. Use synced credentials
   → Access Azure AD
   → Access cloud resources (O365, Azure)
 
4. If Global Admin:
   → Full cloud takeover

#Cloud → On-Prem Chain

text

Cloud to On-Prem Attack Chain
================================
1. Compromise cloud admin
   → Azure AD Global Admin
 
2. Modify AADConnect sync
   → Create new user with DA privileges
 
3. Sync changes to on-premise AD
   → On-prem DA account created
 
4. Access on-premise
   → Full hybrid compromise

#Identity-Based Attacks

#Pass-the-Ticket (Cloud)

bash

# Use Kerberos TGT from cloud
export KRB5CCNAME=ticket.ccache
impacket-psexec domain/user@dc_ip -k -no-pass

#Token Impersonation (Cloud)

text

Token Attack in Cloud
======================
1. Compromise service with high privileges
2. Impersonate token (WindowsIdentity.Impersonate)
3. Access resources as that identity

#Praktik: Cloud Attack Chain Lab

bash

# 1. Setup AWSGoat/AzureGoat
# 2. Start dari compromised EC2/VM
# 3. Follow privilege escalation path
# 4. Reach cloud admin
# 5. Document: detection at each step

#Penutup

Inti yang harus dibawa pulang:

AWS: IAM privilege escalation, metadata service abuse, SSRF → credentials.
Azure/AAD: managed identity abuse, token theft, AADConnect exploitation.
Hybrid chains: on-prem → cloud (via AADConnect), cloud → on-prem (via sync).
Identity-based attacks: the new perimeter — compromise identity, compromise everything.

Di episode 9 selanjutnya, kita akan mempelajari persistence & privilege — golden/silver tickets, persistence mechanisms, dan stealth techniques.