The Open Door

Difficulty:
Direct link: The Open Door

Objective

Request

Help Goose Lucas in the hotel parking lot find the dangerously misconfigured Network Security Group rule that's allowing unrestricted internet access to sensitive ports like RDP or SSH.

Lucas

Solution

Lucas asked me to audit the Dosis Neighborhood's Azure network security configuration for potential overly permissive NSG rules.

The terminal session introduced the challenge and the Azure CLI environment.

The first task was to list resource groups using the command:

az group list

The output listed the available resource groups which are theneighborhood-rg1 and theneighborhood-rg2.

The next task was to list resource groups in table format with the command:

az group list -o table

The table made it easier to spot the neighborhood resource groups.

Task 3 asked to list network security groups using the command:

az network nsg list -o table

The output showed all NSGs and the resource group they are attached to.

The next tasks from here asked to inspect all NSGs and spot the one with a bad configuration. The first NSG to inspect was the web NSG for theneighborhood-rg1. I used the following command:

az network nag show --name nsg-web-eastus --resource-group theneighborhood-rg1 | less

The details show all rules of the web NSG but no particular rule with overly permissible access.

Additional details from the previous NSG output confirmed it was not the issue.

I inspected other NSGs including the management NSG using this command:

az network nag show --name nsg-mgmt-eastus --resource-group theneighborhood-rg2 | less

The details still did not show the exposed rule.

Additional details from the management NSG confirmed no public exposure.

However, when inspecting the production NSG for theneighborhood-rg1, a particular rule with overly permissive access was found.

I used the following command:

az network nag show --name nsg-production-eastus --resource-group theneighborhood-rg1 | less

The rule named Allow-RDP-From-Internet is overly permissive since it allows unrestricted internet access to RDP port.

I decided to inspect the specific rule using the command:

az network nsg rule show --resource-group theneighborhood-rg1 --nsg-name nsg-production-eastus --name Allow-RDP-From-Internet

As visible on the screenshot, I also inspected the Allow-Jumpbox-Remote-Access rule which revealed that the rule does not give public RDP access.

However, the Allow-RDP-From-Internet rule showed unrestricted internet access to RDP, confirming the misconfiguration.

The challenge was also confirmed as a success.

The challenge completed after identifying the risky rule.

The objective was added to the achievements list.

Response

Lucas

Ha! 'Properly protected' they said. More like 'properly exposed to the entire internet'! Good catch, amigo.