Skip to content

Commit 4299f2c

Browse files
carlospolopcarlospolop
committed
virtual desktops
1 parent e675608 commit 4299f2c

5 files changed

Lines changed: 135 additions & 57 deletions

File tree

‎src/SUMMARY.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -454,7 +454,7 @@
454454
- [Az - Primary Refresh Token (PRT)](pentesting-cloud/azure-security/az-lateral-movement-cloud-on-prem/az-primary-refresh-token-prt.md)
455455
- [Az - Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/README.md)
456456
- [Az - Blob Storage Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/az-blob-storage-post-exploitation.md)
457-
- [Az - CosmosDB](pentesting-cloud/azure-security/az-post-exploitation/az-cosmosDB-post-exploitation.md)
457+
- [Az - CosmosDB Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/az-cosmosDB-post-exploitation.md)
458458
- [Az - File Share Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/az-file-share-post-exploitation.md)
459459
- [Az - Function Apps Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/az-function-apps-post-exploitation.md)
460460
- [Az - Key Vault Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/az-key-vault-post-exploitation.md)
@@ -465,6 +465,7 @@
465465
- [Az - Service Bus Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/az-servicebus-post-exploitation.md)
466466
- [Az - Table Storage Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/az-table-storage-post-exploitation.md)
467467
- [Az - SQL Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/az-sql-post-exploitation.md)
468+
- [Az - Virtual Desktop Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/az-virtual-desktop-post-exploitation.md)
468469
- [Az - VMs & Network Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/az-vms-and-network-post-exploitation.md)
469470
- [Az - Privilege Escalation](pentesting-cloud/azure-security/az-privilege-escalation/README.md)
470471
- [Az - Azure IAM Privesc (Authorization)](pentesting-cloud/azure-security/az-privilege-escalation/az-authorization-privesc.md)

‎src/pentesting-cloud/azure-security/az-post-exploitation/az-virtual-desktop-post-exploitation.md‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
# Az - VMs & Network Post Exploitation
2+
3+
{{#include ../../../banners/hacktricks-training.md}}
4+
5+
## Virtual Desktop
6+
7+
For more info about Virtual Desktop check the following page:
8+
9+
{{#ref}}
10+
../az-services/az-virtual-desktop.md
11+
{{#endref}}
12+
13+
### Common techniques
14+
15+
- Overwrite a **MSIX package from the storage account** to get RCE in any VM using that app.
16+
- In a remoteapp it’s possible to change the **path of the binary to execute**.
17+
- **Escape from apps** to a shell to get RCE.
18+
- Any post exploitation attack & persistence from **Azure VMs.**
19+
- It’s possible to **configure a script to be executed** in pool to apply custom configurations
20+
21+
{{#include ../../../banners/hacktricks-training.md}}
22+
23+
24+

‎src/pentesting-cloud/azure-security/az-privilege-escalation/az-virtual-desktop-privesc.md‎

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,27 @@
44

55
## Azure Virtual Desktop Privesc
66

7+
For more info about Azure Virtual Desktop check:
8+
9+
{{#ref}}
10+
../az-services/az-virtual-desktop.md
11+
{{#endref}}
12+
13+
714
### `Microsoft.DesktopVirtualization/hostPools/retrieveRegistrationToken/action`
815
You can retrieve the registration token used to register virtual machines within an host pool.
916

1017
```bash
1118
az desktopvirtualization hostpool retrieve-registration-token -n testhostpool -g Resource_Group_1
1219
```
1320

14-
### ("Microsoft.Authorization/roleAssignments/read", "Microsoft.Authorization/roleAssignments/write") && ("Microsoft.Compute/virtualMachines/read","Microsoft.Compute/virtualMachines/write","Microsoft.Compute/virtualMachines/extensions/read","Microsoft.Compute/virtualMachines/extensions/write")
21+
### Microsoft.Authorization/roleAssignments/read, Microsoft.Authorization/roleAssignments/write
22+
23+
> [!WARNING]
24+
> An attacker with these permissions could do things much more dangerous than this one.
25+
26+
With this permissions you can add a user assignment to the Application group, which is needed to access the virtual machine of the virtual desktop:
1527

16-
With this permissions you can add a user assignment to the Application group, which is needed to access the virtual machine of the virtual desktop.
1728
```bash
1829
az rest --method PUT \
1930
--uri "https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP_NAME>/providers/Microsoft.DesktopVirtualization/applicationGroups/<APP_GROUP_NAME>/providers/Microsoft.Authorization/roleAssignments/<NEW_ROLE_ASSIGNMENT_GUID>?api-version=2022-04-01" \
@@ -25,14 +36,8 @@ az rest --method PUT \
2536
}'
2637
```
2738

28-
Additionally you can change the virtual machine user and password to access it
29-
```bash
30-
az vm user update \
31-
--resource-group <RESOURCE_GROUP_NAME> \
32-
--name <VM_NAME> \
33-
--username <USERNAME> \
34-
--password <NEW_PASSWORD>
35-
```
39+
Note that in order for a user to be able to access a Desktop or an app, he also needs the role `Virtual Machine User Login` or `Virtual Machine Administrator Login` over the VM.
40+
3641

3742
{{#include ../../../banners/hacktricks-training.md}}
3843

‎src/pentesting-cloud/azure-security/az-privilege-escalation/az-virtual-machines-and-network-privesc.md‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -375,6 +375,18 @@ Then the attacker needs to have **compromised somehow the VM** to steal tokens f
375375
https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#azure-vm
376376
{{#endref}}
377377
378+
### "Microsoft.Compute/virtualMachines/read","Microsoft.Compute/virtualMachines/write","Microsoft.Compute/virtualMachines/extensions/read","Microsoft.Compute/virtualMachines/extensions/write"
379+
380+
These permissions allow to change the virtual machine user and password to access it:
381+
382+
```bash
383+
az vm user update \
384+
--resource-group <RESOURCE_GROUP_NAME> \
385+
--name <VM_NAME> \
386+
--username <USERNAME> \
387+
--password <NEW_PASSWORD>
388+
```
389+
378390
### TODO: Microsoft.Compute/virtualMachines/WACloginAsAdmin/action
379391
380392
According to the [**docs**](https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/compute#microsoftcompute), this permission lets you manage the OS of your resource via Windows Admin Center as an administrator. So it looks like this gives access to the WAC to control the VMs...

‎src/pentesting-cloud/azure-security/az-services/az-virtual-desktop.md‎

Lines changed: 82 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -9,57 +9,101 @@ Virtual Desktop is a **desktop and app virtualization service**. It enables to d
99
### Host Pools
1010

1111
Host pools in Azure Virtual Desktop are collections of Azure virtual machines configured as session hosts, providing virtual desktops and apps to users. There are two main types:
12-
- **Personal host pools**, where each virtual machine is dedicated to a single user, with its environments
13-
- **Pooled host pools**, where multiple users share resources on any available session host. It has a configurable session limit and a session host configuration lets Azure Virtual Desktop automate the creation of session hosts based on a configuration
1412

15-
Every host pool has a **registration token** is used to register virtual machines within an host pool.
13+
- **Personal host pools**, where each virtual machine is dedicated to a single user.
14+
- It can be configured so the **admin can assign** specific users to VMs or having this done **automatically**.
15+
- This is ideal for people with intensive workloads as each person will have its own VM. Moreover, they will be able to store files and configure settings in the OS disk and these will persist as **each user has its own VM (host)**.
1616

17-
### Application groups & Workspace
18-
Application groups **control user access** to either a full desktop or specific sets of applications available on session hosts within a host pool. There are two types:
19-
- **Desktop application groups**, which give users access to a complete Windows desktop (available with both personal and pooled host pools)
20-
- **RemoteApp groups**, which allow users to access individual published applications (available only with pooled host pools).
21-
A host pool can have one Desktop application group but multiple RemoteApp groups. Users can be assigned to multiple application groups across different host pools. If a user is assigned both desktop and RemoteApp groups within the same host pool, they only see resources from the preferred group type set by administrators.
17+
- **Pooled host pools**, where multiple **users share resources** on available session hosts.
18+
- It’s possible to configure a **maximum number of users** (sessions) per host.
19+
- It’s possible to **add VMs manually** using a registration keys, or **allow Azure to automatically scale** the number of hosts without having the option of adding VMs using the registration key. It’s not possible to automatically scale VMs for personal pools.
20+
- To persist files in users sessions, it’s needed to use **FSlogix**.
2221

23-
A **workspace** is a **collection of application groups**, allowing users to access the desktops and application groups assigned to them. Each application group must be linked to a workspace, and it can only belong to one workspace at a time.
22+
### Session Hosts
23+
24+
These are the **VMs that users will connect to.**
25+
26+
- If automated scaling was selected, a template will be created with the **characteristics of the hosts** that need to be created for the pool.
27+
- If not, when creating the Host pool it’s possible to indicate the **characteristics and the number of VMs** you want to create and Azure will create and add them for you.
28+
29+
The main features to **configure the VMs** are:
30+
31+
- The **prefix** name of the new VMs
32+
- The **VM type**: This can be “Azure virtual machine” (to use Azure VMs) or “Azure Local virtual machine” which allow hosts to be deployed on-premises or at the edge.
33+
- The location, zones, VM security options, image, CPU, memory, Disk size…
34+
- The **VNet, security group and ports** to expose to the internet
35+
- It’s possible to set credentials to automatically **join an AD domain**, or use Entra ID directory
36+
- If Entra ID, It’s possible to automatically **enroll the new VM in Intune**
37+
- It’s needed to set an **administrator username and password** unless Azure will scale the hosts, in that case a **secret must be configured with the username and another one with the password**
38+
- It’s possible to **configure a script to be executed** for custom configuration
39+
40+
### Application Groups
41+
42+
**Application groups** control user access to either a full desktop or specific sets of applications available on session hosts within a host pool.
43+
44+
There are two types of application groups:
45+
46+
- **Desktop application groups**, which give users access to a complete Windows desktops and attached apps.
47+
- **RemoteApp groups**, which allow users to access individual applications.
48+
- It’s not possible to assign this kind of application group to a Personal Pool.
49+
- It’s needed to indicate the path to the binary to execute inside the VM.
50+
51+
A Pooled Pool can have **one Desktop application** group and **multiple RemoteApp groups** and users can be assigned to multiple application groups across different host pools.
52+
53+
When a user is **granted access** it’s given the role **`Desktop Virtualization User`** over the application group.
54+
55+
### Workspaces & Connections
56+
57+
A **workspace** is a collection of application groups.
58+
59+
In order to **connect** to the Desktop or apps assigned it’s possible to do so from [https://windows365.microsoft.com/ent#/devices](https://windows365.microsoft.com/ent#/devices)
60+
And there are other methods described on [https://learn.microsoft.com/en-us/azure/virtual-desktop/users/connect-remote-desktop-client](https://learn.microsoft.com/en-us/azure/virtual-desktop/users/connect-remote-desktop-client)
61+
62+
When a user access his account he is going to be **presented separated by workspaces everything he has access to**. Therefore, it’s needed to add **each application group to one workspace** in order for the defined accesses to be visible.
63+
64+
In order for a user to be able to access a Desktop or an app, he also needs the role **`Virtual Machine User Login`** or **`Virtual Machine Administrator Login`** over the VM.
65+
66+
### Managed Identities
67+
68+
It’s not possible to assign managed identities to host pools so the created VMs inside a pool will have them.
69+
However, it’s possible to **assign system and user managed identities to the VMs** and then access the tokens from the metadata. Actually, after launching the host pools form the web, the 2 generated VMs have the system assigned managed identity enabled (although it doesn’t have any permissions).
2470

25-
### Key Features
26-
- **Flexible VM Creation**: Create Azure virtual machines directly or add Azure Local virtual machines later.
27-
- **Security Features**: Enable Trusted Launch (secure boot, vTPM, integrity monitoring) for advanced VM security (a virtual network is needed). Can integrate Azure Firewall and control traffic via Network Security Groups.
28-
- **Domain Join**: Support for Active Directory domain joins with customizable configurations.
29-
- **Diagnostics & Monitoring**: Enable Diagnostic Settings to stream logs and metrics to Log Analytics, storage accounts, or event hubs for monitoring.
30-
- **Custom image templates**: Create and manage them to use when adding session hosts. Easily add common customizations or your own custom scripts.
31-
- **Workspace Registration**: Easily register default desktop application groups to new or existing workspaces for simplified user access management.
3271

3372
### Enumeration
3473

3574
```bash
3675
az extension add --name desktopvirtualization
3776

38-
# List HostPool of a Resource group
39-
az desktopvirtualization hostpool list --resource-group <Resource_Group>
77+
# List HostPools
78+
az desktopvirtualization hostpool list
79+
80+
# List Workspaces
81+
az desktopvirtualization workspace list
4082

4183
# List Application Groups
42-
az desktopvirtualization applicationgroup list --resource-group <Resource_Group>
43-
# List Application Groups By Subscription
44-
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.DesktopVirtualization/applicationGroups?api-version=2024-04-03"
84+
az desktopvirtualization applicationgroup list
85+
4586
# List Applications in a Application Group
4687
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/applicationGroups/{applicationGroupName}/applications?api-version=2024-04-03"
88+
89+
# Check if Desktops are enabled
90+
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/applicationGroups/{applicationGroupName}/desktops?api-version=2024-04-03"
91+
4792
# List Assigned Users to the Application Group
4893
az rest \
4994
--method GET \
5095
--url "https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP_NAME>/providers/Microsoft.DesktopVirtualization/applicationGroups/<APP_GROUP_NAME>/providers/Microsoft.Authorization/roleAssignments?api-version=2022-04-01" \
5196
| jq '.value[] | select((.properties.scope | ascii_downcase) == "/subscriptions/<subscription_id_in_lowercase>/resourcegroups/<resource_group_name_in_lowercase>/providers/microsoft.desktopvirtualization/applicationgroups/<app_group_name_in_lowercase>")'
5297

98+
# List hosts
99+
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/hostPools/{hostPoolName}/sessionHosts?api-version=2024-04-03"
53100

54-
# List Workspace in a resource group
55-
az desktopvirtualization workspace list --resource-group <Resource_Group>
56-
# List Workspace in a subscription
57-
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.DesktopVirtualization/workspaces?api-version=2024-04-03"
58-
59-
# List App Attach Package By Resource Group
101+
# List App Attach packages
60102
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/appAttachPackages?api-version=2024-04-03"
61-
# List App Attach Package By Subscription
62-
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.DesktopVirtualization/appAttachPackages?api-version=2024-04-03"
103+
104+
# List user sessions
105+
az rest --method GET --url "https://management.azure.com/ssubscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/hostpools/{hostPoolName}/sessionhosts/{hostPoolHostName}/userSessions?api-version=2024-04-03"
106+
63107

64108
# List Desktops
65109
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/applicationGroups/{applicationGroupName}/desktops?api-version=2024-04-03"
@@ -69,37 +113,29 @@ az rest --method GET --url "https://management.azure.com/subscriptions/{subscrip
69113

70114
# List private endpoint connections associated with hostpool.
71115
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/hostPools/{hostPoolName}/privateEndpointConnections?api-version=2024-04-03"
116+
72117
# List private endpoint connections associated By Workspace.
73118
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/workspaces/{workspaceName}/privateEndpointConnections?api-version=2024-04-03"
74119

75120
# List the private link resources available for a hostpool.
76121
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/hostPools/{hostPoolName}/privateLinkResources?api-version=2024-04-03"
122+
77123
# List the private link resources available for this workspace.
78124
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/workspaces/{workspaceName}/privateLinkResources?api-version=2024-04-03"
79-
80-
# List sessionHosts/virtual machines.
81-
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/hostPools/{hostPoolName}/sessionHosts?api-version=2024-04-03"
82-
83-
# List start menu items in the given application group.
84-
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/applicationGroups/{applicationGroupName}/startMenuItems?api-version=2024-04-03"
85-
86-
# List userSessions.
87-
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/hostPools/{hostPoolName}/sessionHosts/{sessionHostName}/userSessions?api-version=2024-04-03"
88-
# List userSessions By Host Pool
89-
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/hostPools/{hostPoolName}/userSessions?api-version=2024-04-03"
90-
91125
```
92126

93-
### Connection
94-
95-
To connect to the virtual desktop via web you can access through https://client.wvd.microsoft.com/arm/webclient/ (most common), or https://client.wvd.microsoft.com/webclient/index.html (classic)
96-
There are other methods that are described here [https://learn.microsoft.com/en-us/azure/virtual-desktop/users/connect-remote-desktop-client?tabs=windows](https://learn.microsoft.com/en-us/azure/virtual-desktop/users/connect-remote-desktop-client?tabs=windows)
97-
98127
## Privesc
99128

100129
{{#ref}}
101130
../az-privilege-escalation/az-virtual-desktop-privesc.md
102131
{{#endref}}
103132

133+
## Post Exploitation & Persistence
134+
135+
{{#ref}}
136+
../az-post-exploitation/az-virtual-desktop-post-exploitation.md
137+
{{#endref}}
138+
139+
104140
{{#include ../../../banners/hacktricks-training.md}}
105141

0 commit comments

Comments
 (0)