Scoutsuite: Document MFA usage with Azure

[infosecconsultant]

Hi,

I am trying to test a azure instance that due to a global GPO enforces the usage of MFA on all administrator accounts.

When I attempt to access the instance using the below command I get the following errors.

C:> python Scout.py azure --user-account
Username: [email protected]
Password:
Failed to authenticate to Azure
, AdalError: Get Token request returned http error: 400 and server response: {"error":"interaction_required","error_description":"AADSTS50076: Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaa'.\r\nTrace ID: ffffffff-ffff-ffff-ffff-ffffffffffff\r\nCorrelation ID: ffffffff-ffff-ffff-ffff-00000000\r\nTimestamp: 2019-03-18 02:13:15Z","error_codes":[50076],"timestamp":"2019-03-18 02:13:15Z","trace_id":"ffffffff-ffff-ffff-ffff-ffffffffffff","correlation_id":"ffffffff-ffff-ffff-ffff-00000000","suberror":"basic_action"}

Is there any way the script can support MFA?

Thanks,

[x4v13r64]

MFA isn't supported in the python SDK for username/password auth.

@zer0x64 could you have a look at the two auth flows described in https://github.com/AzureAD/azure-activedirectory-library-for-python/issues/116#issuecomment-370096629? I'm not sure if this is something we could leverage to allow running Scout where MFA is activated?

@infosecconsultant does one of the other available authentication methods suit your requirements?

[zer0x64]

@infosecconsultant Have you try login in with the azure cli authentication method? From what I see, this would handle the MFA when running az login before running Scout and should work, but we haven't tested yet on our side.

[zer0x64]

@j4v The two examples uses straight ADAL authentication, which doesn't seems to be easily compatible with the azure SDK the way we use it. I remember when implementing azure auth that I ended up completely avoiding ADAL.

Although, I think login in using the CLI would probably work and is pretty similar to the way AWS MFA works as of the last release.

[infosecconsultant]

Hi @zer0x64 @j4v

You are correct, it is possible to get the MFA working when generating a valid authentication token via the CLI. Related, but the reason I didn't originally try this method is because it complained about a dependency mismatch when installing via pip. Even though there's a mismatch it still works just fine.

Would be good to add "Use az login to generate token and then log in via --cli for 2FA support" to the doco just to clarify for future users.

Thanks!

[infosecconsultant]

Would also be good to handle that error

Due to a configuration change made by your administrator, or because you moved to a new location, you must use multi-factor authentication to access

To suggest using --cli instead.

[x4v13r64]

You are correct, it is possible to get the MFA working when generating a valid authentication token via the CLI.

:tada:

Would be good to add "Use az login to generate token and then log in via --cli for 2FA support" to the doco just to clarify for future users.

Would also be good to handle that error

:+1:

[zer0x64]

There isn't really any provider-specific pages in the wiki yet, so I've created a Draft for azure containing only this information for now:
https://github.com/nccgroup/ScoutSuite/wiki/(Draft)-Azure

[rayluo]

So, that "Use az login to generate token and then log in via --cli for 2FA support" workaround works, because az cli uses both of the alternatives mentioned here. It is clever that you guys can piggyback on it to make your scenario work. :-)

As a side note, @zer0x64 next time you want to do azure auth, you can give MSAL Python a try.

[x4v13r64]

@rayluo does MSAL allow MFA auth without the use of the azure-cli? i.e. directly with username/password.

[rayluo]

To be clear, it is not a MSAL (or ADAL, for that matter) limitation that username/password flow is usually restricted by the MFA requirement. MFA is typically configured by the admin for better security. But a textbook username/password flow requires end user to input his/her username and password to your script, which simply won't have the interactive UI to finish the MFA requirement.

The way that azure-cli satisfies the MFA requirement, is that it indeed uses the suggestion I made earlier, to use the authorization code flow (by conceptually starting a mini HTTP server locally under the hood, and later shut it down), or the device code flow (which does not require a local HTTP server). Either way, the end user inputs his/her username password via the browser. Azure-cli does use ADAL/MSAL to complete those 2 flows, but azure-cli handles that local http server thing by itself, and MSAL Python does not do that.

For now, I still think you can consider using Device Flow, which is very simple to implement. See this sample.

[x4v13r64]

@rayluo thanks, we'll look to add MFA support for username/password flow as you've detailed above :smile: .

[x4v13r64]

Closing as this has now been implemented as part of https://github.com/nccgroup/ScoutSuite/pull/603.

Useful references:

• https://docs.microsoft.com/en-us/samples/azure-samples/data-lake-analytics-python-auth-options/authenticating-your-python-application-against-azure-active-directory/
• https://github.com/AzureAD/azure-activedirectory-library-for-python/wiki/Acquire-tokens