Stephen Bradshaw's blog about pentesting and computer security
Introduction In Kubernetes environments using Istio you have the option of delegating access control decisions to a custom application, rather than relying solely on Istio’s built-in Role-Based Access Control (RBAC). This concept is discussed in more detail here . This approach works as follows: When an incoming HTTP request to the cluster enters the Istio mesh to be routed, Istio pauses the…
Introduction Last weekend, I presented at BSides Canberra on the topic of abusing native cloud services for Command and Control (C2). The talk discussed the concept of the high reputation redirector, why these are used in Command and Control designs, and listed a number of ways to create these redirectors using native cloud services from AWS, Azure and GCP. The slides from the presesntation are…
Heres the third entry in my series on abusing AWS services to provide C2 high reputation redirectors. The first part in this series was all the way back in 2023 , and in it I discussed abusing the following services to provide a trusted endpoint for C2 communications: API Gateway direct proxying, Lambda receiving traffic through either Function Urls or the API Gateway , Amplify apps and,…
Back in July this year I released the fourth and (I thought) final entry in my series on exploiting Azure native services to provide high reputation C2 redirectors. Well, things move fast in cloud land, and I’ve discovered yet another Azure service that can be abused for this purpose - Azure Container Apps . So now here is the final FINAL entry in the Azure specific series. (I also have entries…
Heres a second entry in my series on abusing AWS services to provide high reputation redirectors for Command and Control. The first AWS part in this series was all the way back in 2023 , and in that entry I discussed abusing the following services to provide a trusted endpoint for C2 implant communications: API Gateway direct proxying, Lambda receiving traffic through either Function Urls or the…
Heres the final (for now at least) entry in my series on abusing Azure services to provide high reputation redirectors for Command and Control. This time around, we are looking at Azure’s API Management (APIM) Service . This service actually gives us a number of different configurations we can use to stick a trusted HTTP frontend in front of other Azure components, however in the example below I…
Another quick entry in my ongoing series where I find ways to use cloud native services to receive command and control traffic - Azure edition. A simple trick we can use in Azure environments to get a trusted domain for a C2 endpoint is automatically generated VM domain names. A VM you create in Azure can have a DNS record in the format <domainNameLabel>.<region>.cloudapp.azure.com automatically…
Here is another entry in my ongoing series of posts where I find ways to abuse cloud native services for fronting C2 implant traffic. This time I will be discussing the second Azure specific approach using Azure Front Door . For the first Azure specific post, you can go here , and for all of the other posts, also covering AWS and GCP, you can go here . Overview Azure Front Door is essentially a…
As Ive been playing with Azure on and off over the last few weeks trying to find native services abusable for C2 fronting, I’ve developed a need to quickly setup and tear down POC C2 environments so I can avoid being billed for cloud resources during idle periods. To this end, Ive created some simple Azure Resource Manager templates that allow me to quickly setup the resources mentioned in my…
This is a continuation of an ongoing series of blog posts I have made on the topic of using cloud provider native services to provide high reputation redirectors for command and control HTTP/S implant traffic. I have previously looked at this topic for services in GCP and AWS , and now I’m looking at Azure. This post will look at how we can use Azure Functions to forward implant traffic. If you…