From ee37fbe3ebbfae86294bb6ea8c7a02786c545fd2 Mon Sep 17 00:00:00 2001 From: SirBroccoli Date: Thu, 26 Dec 2024 01:57:00 +0000 Subject: [PATCH] GITBOOK-742: No subject --- SUMMARY.md | 3 +- .../az-app-services-privesc.md | 67 ++++++++ ...zure-app-service.md => az-app-services.md} | 144 +++++++++++++----- .../az-services/az-function-apps.md | 12 ++ .../azure-security/az-services/az-sql.md | 2 +- .../azure-security/az-services/vms/README.md | 18 +-- 6 files changed, 196 insertions(+), 50 deletions(-) create mode 100644 pentesting-cloud/azure-security/az-privilege-escalation/az-app-services-privesc.md rename pentesting-cloud/azure-security/az-services/{az-azure-app-service.md => az-app-services.md} (54%) diff --git a/SUMMARY.md b/SUMMARY.md index 211dec980c..0b55216c4d 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -408,7 +408,7 @@ * [Az - ARM Templates / Deployments](pentesting-cloud/azure-security/az-services/az-arm-templates.md) * [Az - Automation Account](pentesting-cloud/azure-security/az-services/az-automation-account/README.md) * [Az - State Configuration RCE](pentesting-cloud/azure-security/az-services/az-automation-account/az-state-configuration-rce.md) - * [Az - Azure App Service & Function Apps](pentesting-cloud/azure-security/az-services/az-azure-app-service.md) + * [Az - App Services](pentesting-cloud/azure-security/az-services/az-app-services.md) * [Az - Intune](pentesting-cloud/azure-security/az-services/intune.md) * [Az - File Shares](pentesting-cloud/azure-security/az-services/az-file-shares.md) * [Az - Function Apps](pentesting-cloud/azure-security/az-services/az-function-apps.md) @@ -451,6 +451,7 @@ * [Az - VMs & Network Post Exploitation](pentesting-cloud/azure-security/az-post-exploitation/az-vms-and-network-post-exploitation.md) * [Az - Privilege Escalation](pentesting-cloud/azure-security/az-privilege-escalation/README.md) * [Az - Azure IAM Privesc (Authorization)](pentesting-cloud/azure-security/az-privilege-escalation/az-authorization-privesc.md) + * [Az - App Services Privesc](pentesting-cloud/azure-security/az-privilege-escalation/az-app-services-privesc.md) * [Az - EntraID Privesc](pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/README.md) * [Az - Conditional Access Policies & MFA Bypass](pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md) * [Az - Dynamic Groups Privesc](pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/dynamic-groups.md) diff --git a/pentesting-cloud/azure-security/az-privilege-escalation/az-app-services-privesc.md b/pentesting-cloud/azure-security/az-privilege-escalation/az-app-services-privesc.md new file mode 100644 index 0000000000..92ecc5e14d --- /dev/null +++ b/pentesting-cloud/azure-security/az-privilege-escalation/az-app-services-privesc.md @@ -0,0 +1,67 @@ +# Az - App Services Privesc + +{% hint style="success" %} +Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ +Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte) + +
+ +Support HackTricks + +* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! +* **Join the** πŸ’¬ [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.** +* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos. + +
+{% endhint %} + +## App Services + +For more information about Azure App services check: + +{% content-ref url="../az-services/az-app-services.md" %} +[az-app-services.md](../az-services/az-app-services.md) +{% endcontent-ref %} + +### Microsoft.Web/sites/publish/Action, Microsoft.Web/sites/basicPublishingCredentialsPolicies/read, Microsoft.Web/sites/config/read, Microsoft.Web/sites/read, + +These permissions allows to call the following commands to get a **SSH shell** inside a web app + +* Direct option: + +```bash +# Direct option +az webapp ssh --name --resource-group +``` + +* Create tunnel and then connect to SSH: + +{% code overflow="wrap" %} +```bash +az webapp create-remote-connection --name --resource-group + +## If successfull you will get a message such as: +#Verifying if app is running.... +#App is running. Trying to establish tunnel connection... +#Opening tunnel on port: 39895 +#SSH is available { username: root, password: Docker! } + +## So from that machine ssh into that port (you might need generate a new ssh session to the jump host) +ssh root@127.0.0.1 -p 39895 +``` +{% endcode %} + +{% hint style="success" %} +Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ +Learn & practice GCP Hacking: [**HackTricks Training GCP Red Team Expert (GRTE)**](https://training.hacktricks.xyz/courses/grte) + +
+ +Support HackTricks + +* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)! +* **Join the** πŸ’¬ [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.** +* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos. + +
+{% endhint %} diff --git a/pentesting-cloud/azure-security/az-services/az-azure-app-service.md b/pentesting-cloud/azure-security/az-services/az-app-services.md similarity index 54% rename from pentesting-cloud/azure-security/az-services/az-azure-app-service.md rename to pentesting-cloud/azure-security/az-services/az-app-services.md index 4f5d822c82..c8d1139dc1 100644 --- a/pentesting-cloud/azure-security/az-services/az-azure-app-service.md +++ b/pentesting-cloud/azure-security/az-services/az-app-services.md @@ -1,4 +1,4 @@ -# Az - Azure App Service & Function Apps +# Az - App Services {% hint style="success" %} Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ @@ -17,7 +17,7 @@ Learn & practice GCP Hacking: -n +# Get info about 1 app +az webapp show --name --resource-group + +# Get instances of a webapp +az webapp list-instances --name --resource-group +## If you have enough perm you can go to the "consoleUrl" and access a shell inside the instance form the web + +# Get configured Auth information +az webapp auth show --name --resource-group + +# Get access restrictions of an app +az webapp config access-restriction show --name --resource-group # Remove access restrictions az webapp config access-restriction remove --resource-group -n --rule-name +# Get appsettings of an app +az webapp config appsettings list --name --resource-group + +# Get backups of a webapp +az webapp config backup list --webapp-name --resource-group + +# Get backups scheduled for a webapp +az webapp config backup show --webapp-name --resource-group + # Get snapshots az webapp config snapshot list --resource-group -n # Restore snapshot az webapp config snapshot restore -g -n --time 2018-12-11T23:34:16.8388367 -# Restart webapp -az webapp restart --name --resource-group +# Get connection strings of a webapp +az webapp config connection-string list --name --resource-group + +# Get used container by the app +az webapp config container show --name --resource-group + +# Get storage account configurations of a webapp +az webapp config storage-account list --name --resource-gl_group + + + + + + + + +# List all the functions +az functionapp list + +# Get info of 1 funciton (although in the list you already get this info) +az functionapp show --name --resource-group +## If "linuxFxVersion" has something like: "DOCKER|mcr.microsoft.com/..." +## This is using a container + +# Get details about the source of the function code +az functionapp deployment source show \ + --name \ + --resource-group +## If error like "This is currently not supported." +## Then, this is probalby using a container + +# Get more info if a container is being used +az functionapp config container show \ + --name \ + --resource-group + +# Get settings (and privesc to the sorage account) +az functionapp config appsettings list --name --resource-group + +# Check if a domain was assigned to a function app +az functionapp config hostname list --webapp-name --resource-group + +# Get SSL certificates +az functionapp config ssl list --resource-group + +# Get network restrictions +az functionapp config access-restriction show --name --resource-group + +# Get more info about a function (invoke_url_template is the URL to invoke and script_href allows to see the code) +az rest --method GET \ + --url "https://management.azure.com/subscriptions//resourceGroups//providers/Microsoft.Web/sites//functions?api-version=2024-04-01" + +# Get source code with Master Key of the function +curl "?code=" +## Python example +curl "https://newfuncttest123.azurewebsites.net/admin/vfs/home/site/wwwroot/function_app.py?code=" -v + +# Get source code +az rest --url "https://management.azure.com//resourceGroups//providers/Microsoft.Web/sites//hostruntime/admin/vfs/function_app.py?relativePath=1&api-version=2022-03-01" ``` {% endcode %} {% endtab %} @@ -121,44 +216,17 @@ git clone 'https://:@name.scm.azurewebsites.net/repo-name.gi ## If you change the code and do a push, the app is automatically redeployed ``` -#### Access to the Docker container with the webapp via ssh: -```bash -# Get ssh session -az webapp create-remote-connection --subscription --resource-group -n -## If successfull you will get a message such as: -#Verifying if app is running.... -#App is running. Trying to establish tunnel connection... -#Opening tunnel on port: 39895 -#SSH is available { username: root, password: Docker! } +## Privilege Escalation -## So from that machine ssh into that port (you might need generate a new ssh session to the jump host) -ssh root@127.0.0.1 -p 39895 -``` - -## Function Apps Basic Information - -Azure Functions is a **serverless** solution that allows you to write less code, maintain less infrastructure, and save on costs. Instead of worrying about deploying and maintaining servers, the cloud infrastructure provides all the up-to-date resources needed to keep your applications running. - -In the Azure portal, integration between Azure Functions and Azure API Management is facilitated, allowing **HTTP trigger function endpoints to be exposed as REST APIs**. The APIs exposed in this manner are described using an OpenAPI definition, providing a standard, language-agnostic interface to RESTful APIs. - -**Function Apps support Managed Identities.** - -Moreover Function App might have certain endpoints that require a certain level of authentication, such as "admin" or "anonymous".\ -An attacker could try to access the **anonymous allowed endpoints** to bypass the restrictions and gain access to sensitive data or functionality. - -### Enumeration - -```powershell -# Get only Function Apps -Get-AzFunctionApp -``` +{% content-ref url="../az-privilege-escalation/az-app-services-privesc.md" %} +[az-app-services-privesc.md](../az-privilege-escalation/az-app-services-privesc.md) +{% endcontent-ref %} ## References * [https://learn.microsoft.com/en-in/azure/app-service/overview](https://learn.microsoft.com/en-in/azure/app-service/overview) -* [https://learn.microsoft.com/en-us/azure/azure-functions/functions-openapi-definition](https://learn.microsoft.com/en-us/azure/azure-functions/functions-openapi-definition) {% hint style="success" %} Learn & practice AWS Hacking:[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)\ diff --git a/pentesting-cloud/azure-security/az-services/az-function-apps.md b/pentesting-cloud/azure-security/az-services/az-function-apps.md index 284e8aeb61..a446ab37d6 100644 --- a/pentesting-cloud/azure-security/az-services/az-function-apps.md +++ b/pentesting-cloud/azure-security/az-services/az-function-apps.md @@ -19,6 +19,10 @@ Learn & practice GCP Hacking: .azurewebsites.net/api/?code=` {% endhint %} +### Basic Authentication + +Just like in App Services, Functions also support basic authentication to connect to **SCM** and **FTP** to deploy code using a **username and password in a URL** provided by Azure. More information about it in: + +{% content-ref url="az-app-services.md" %} +[az-app-services.md](az-app-services.md) +{% endcontent-ref %} + ### Github Based Deployments When a function is generated from a Github repo Azure web console allows to **automatically create a Github Workflow in a specific repository** so whenever this repository is updated the code of the function is updated. Actually the Github Action yaml for a python function looks like this: diff --git a/pentesting-cloud/azure-security/az-services/az-sql.md b/pentesting-cloud/azure-security/az-services/az-sql.md index cf63f9c56b..34d0ff9ed3 100644 --- a/pentesting-cloud/azure-security/az-services/az-sql.md +++ b/pentesting-cloud/azure-security/az-services/az-sql.md @@ -43,7 +43,7 @@ az sql vm show --resource-group --name ### Connect and run SQL queries -You could find a connection string (containing credentials) from example [enumerating an Az WebApp](az-azure-app-service.md): +You could find a connection string (containing credentials) from example [enumerating an Az WebApp](az-app-services.md): {% code overflow="wrap" %} ```powershell diff --git a/pentesting-cloud/azure-security/az-services/vms/README.md b/pentesting-cloud/azure-security/az-services/vms/README.md index e664d118d3..ad081b59a0 100644 --- a/pentesting-cloud/azure-security/az-services/vms/README.md +++ b/pentesting-cloud/azure-security/az-services/vms/README.md @@ -78,6 +78,7 @@ az disk show --name --resource-group ``` {% endcode %} {% endtab %} + {% tab title="PowerShell" %} {% code overflow="wrap" %} ```powershell @@ -91,7 +92,6 @@ Get-AzDisk -Name -ResourceGroupName {% endtab %} {% endtabs %} - ## Images, Gallery Images & Restore points A **VM image** is a template that contains the operating system, application settings and filesystem needed to **create a new virtual machine (VM)**. The difference between an image and a disk snapshot is that a disk snapshot is a read-only, point-in-time copy of a single managed disk, used primarily for backup or troubleshooting, while an image can contain **multiple disks and is designed to serve as a template for creating new VMs**.\ @@ -135,6 +135,7 @@ az restore-point collection show --collection-name --resource- ``` {% endcode %} {% endtab %} + {% tab title="PowerShell" %} {% code overflow="wrap" %} ```powershell @@ -170,7 +171,7 @@ From the [**docs**](https://learn.microsoft.com/en-us/azure/site-recovery/site-r ## Azure Bastion -Azure Bastion enables secure and seamless **Remote Desktop Protocol (RDP)** and **Secure Shell (SSH)** access to your virtual machines (VMs) directly through the Azure Portal or via a jump box. By **eliminating the need for public IP addresses** on your VMs. +Azure Bastion enables secure and seamless **Remote Desktop Protocol (RDP)** and **Secure Shell (SSH)** access to your virtual machines (VMs) directly through the Azure Portal or via a jump box. By **eliminating the need for public IP addresses** on your VMs. The Bastion deploys a subnet called **`AzureBastionSubnet`** with a `/26` netmask in the VNet it needs to work on. Then, it allows to **connect to internal VMs through the browser** using `RDP` and `SSH` avoiding exposing ports of the VMs to the Internet. It can also work as a **jump host**. @@ -203,6 +204,7 @@ az network bastion rdp \ ``` {% endcode %} {% endtab %} + {% tab title="PowerShell" %} {% code overflow="wrap" %} ```powershell @@ -225,8 +227,6 @@ Check how to enumerate it in: ## VM Enumeration -{% tabs %} -{% tab title="Az Cli" %} {% code overflow="wrap" %} ```bash # VMs @@ -364,8 +364,9 @@ az resource list --resource-type "Microsoft.Compute/virtualMachines" --query "[] az vm run-command list --output table ``` {% endcode %} -{% endtab %} -{% tab title="Az PS" %} + + + ```powershell # Get readable VMs Get-AzVM | fl @@ -455,9 +456,6 @@ Get-AzStorageAccount ## List all custom script extensions on a specific VM Get-AzVMExtension -VMName -ResourceGroupName ``` -{% endcode %} -{% endtab %} -{% endtabs %} ## Code Execution in VMs @@ -483,6 +481,7 @@ az vm extension image list --publisher "Site24x7" --output table ``` {% endcode %} {% endtab %} + {% tab title="PowerShell" %} {% code overflow="wrap" %} ```powershell @@ -493,7 +492,6 @@ Get-AzVMExtensionImage -Location -PublisherName -Type {% endtab %} {% endtabs %} - It's possible to **run custom extensions that runs custom code**: {% tabs %}