Microsoft Azure proofs

[PatrikHudak]

Service name

Microsoft Azure

Proof

There is no general approach for PoC. Microsoft Azure offers multiple services (CloudApp, Azure Websites, etc.) that use different domain names.

General approach in verifying subdomain takeover is to check, whether the Azure domain responds with NXDOMAIN DNS status. This is (to my knowledge) the necessary condition of the domain, however it is not sufficient. In other words, not all Azure domains which are used in some CNAME and respond with NXDOMAIN are vulnerable to subdomain takeover. I personally got a case where Azure portal refused to create a domain even though it responded with NXDOMAIN.

Some H1 reports to prove this point:

• https://0xpatrik.com/subdomain-takeover-starbucks/ (HackerOne: https://hackerone.com/reports/325336)
• https://0xpatrik.com/subdomain-takeover-starbucks-ii/ (HackerOne: https://hackerone.com/reports/388622)

As mentioned before, the PoC creation depends on the service in question, however, they generally tend to have similar workflows.

Documentation

These are the domains that are identified as vulnerable. Each of these is used for particular Azure service:

• *.cloudapp.net
• *.cloudapp.azure.com
• *.azurewebsites.net
• *.blob.core.windows.net
• *.cloudapp.azure.com
• *.azure-api.net
• *.azurehdinsight.net
• *.azureedge.net
• *.azurecontainer.io
• *.database.windows.net
• *.azuredatalakestore.net
• *.search.windows.net
• *.azurecr.io
• *.redis.cache.windows.net
• *.azurehdinsight.net
• *.servicebus.windows.net
• *.visualstudio.com

[Sechunt3r]

Hi All,
Hope you are good!

if a Azure Domain not Respond with NXDOMAIN that means it is not Vulnerable.
But if it shows this ;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR,

Then what would be the answer is it vulnerable or not!

Hope you understand my points

Regards
Shivam

[codingo]

Linked back on the main repository, closing this as @Sechunt3r's comment is already addressed in @PatrikHudak's summary.

[ghsec]

if subdomain return public IP is possible subdomain takeover?

[sumgr0]

If the sub-domain points to traffic manager service for Azure, is the takeover possible? When attempting to create a traffic manager profile using the same name as in the CNAME, getting error which mentions "Domain name xyz.trafficmanager.net already exists. Please choose a different DNS prefix".

Has Microsoft patched the service or am I doing something wrong?

Thanks

[PatrikHudak]

@sumgro Microsoft haven't patched the service and you are doing everything ok.

You are getting a error message because the Traffic Manager profile actually EXIST, so you are unable to claim it. When you make a DNS request to *.trafficmanager.net and get NXDOMAIN there are two possible outcomes:

1. The Traffic Manager with requested name really don't exist - you can go ahead and register it. In this context it is likely that the Subdomain Takeover is possible.
2. (From my own testing) Traffic Manager profile can be created, however there is no requirement to assign it any endpoints by default. Traffic Manager (as the name) implies is trying to distribute network traffic using different settings and acts just as a middleman. This means that in order it to work, you need to set up endpoints (a.k.a. FQDN) where the traffic will be forwarded once the user reaches to something.trafficmanager.net. Now to the core of the problem: When there is no endpoint assigned in the profile, you will get the same NXDOMAIN response as you would get with non-existing TM profile. In this case, you won't be able to take in over because the TM profile with the name in CNAME record actually exist, it just seems that the profile does not exist.

It is pretty easy to setup a automation for that using Azure API. You would need to test a creation of particular TM profile and not rely only on DNS request as some external indicator of TM profile existence.

Hope it helps.

[sumgr0]

Thank you for the revert @PatrikHudak, really appreciate the detailed reply.

I'm fairly new to the subdomain takeover subject. When testing for the subdomain in question, the dig <subdomain.domain.com> confirmed the error NXDOMAIN (thereby bringing a smile) and then the CNAME pointed to xyz.trafficmanager.net.

From your reply, I understand that the profile already exists with the same name as the CNAME, even when the end-point may not have been setup, this results in the error message both when visiting the link and through the dig command. Hence, the takeover for in this situation may not be successful.

Not able to get the pointers on the Azure API for automation, kindly point in the direction to be able to research more on the topic to get an understand for future hunting.

Thanks

[sumgr0]

I've come across a sub-domain, pointing to an azure web app service. This CNAME itself has 3 levels like xyz.abc.m.azurewebsites.net. It shows the NXDOMAIN error when checking with dig.

However, when I try to create the App on the Azure Portal as xyz.abc.m to takeover, it does not allow periods in the same. Anyone aware of how can such scenario be handled for sub-domain takeover?

Thanks

[nikokosm]

I also faced this. I found a subdomain that resolved to xyz.easteurope.cloudapp.azure.com and could not use the . character. Anyone else got around this?

Edit: turns out you could take over this by registering an Azure VM in the easteurope region ;)

[sumgr0]

found this in relation to the above, but haven't been able to go through in details to understand:
https://docs.microsoft.com/en-us/azure/app-service/environment/using-an-ase

[AdmiralGaust]

I found a subdomain pointing to 104.211.97.138. The ip certificate is issued to *.azurewebsites.net and the subdomain does not contain txt record.

Is it vulnerable to subdomain takeover?