# Az - Logic Apps Privesc

{{#include ../../../banners/hacktricks-training.md}}

## Logic Apps Privesc
Vir meer inligting oor SQL Database, kyk:

{{#ref}}
../az-services/az-logic-apps.md
{{#endref}}

### (`Microsoft.Resources/subscriptions/resourcegroups/read`, `Microsoft.Logic/workflows/read`, `Microsoft.Logic/workflows/write` && `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action`) && (`Microsoft.Logic/workflows/triggers/run/action`)

Met hierdie toestemming kan jy Azure Logic Apps workflows skep of opdateer. Workflows definieer geoutomatiseerde prosesse en integrasies tussen verskillende stelsels en dienste.
```bash
az logic workflow create \
--resource-group <resource_group_name> \
--name <workflow_name> \
--definition <workflow_definition_file.json> \
--location <location>

az logic workflow update \
--name my-new-workflow \
--resource-group logicappgroup \
--definition <workflow_definition_file.json>
```
En nadat jy dit verander het, kan jy dit uitvoer met:
```bash
az rest \
--method post \
--uri "https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Logic/workflows/{logicAppName}/triggers/{triggerName}/run?api-version=2016-10-01" \
--body '{}' \
--headers "Content-Type=application/json"
```
Boonop met net `Microsoft.Logic/workflows/write` kan jy die Outeurskapbeleid verander, wat byvoorbeeld 'n ander tenant die vermoë gee om die werksvloei te aktiveer:
```bash
az rest --method PUT \
--uri "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Logic/workflows/<workflow-name>?api-version=2016-10-01" \
--body '{
"location": "<region>",
"properties": {
"definition": {
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"$connections": {
"defaultValue": {},
"type": "Object"
}
},
"triggers": {
"<trigger-name>": {
"type": "Request",
"kind": "Http"
}
},
"actions": {},
"outputs": {}
},
"accessControl": {
"triggers": {
"openAuthenticationPolicies": {
"policies": {
"<policy-name>": {
"type": "AAD",
"claims": [
{
"name": "iss",
"value": "<issuer-url>"
}
]
}
}
}
}
}
}
}'

```
### `Microsoft.Logic/workflows/triggers/listCallbackUrl/action`
Jy kan die terugroep-URL van die sneller kry en dit uitvoer.
```bash
az rest --method POST \
--uri "https://management.azure.com/subscriptions/<subscription_id>/resourceGroups/<resource_group>/providers/Microsoft.Logic/workflows/<workflow_name>/triggers/<trigger_name>/listCallbackUrl?api-version=2019-05-01"
```
Dit sal 'n terugroep-URL soos `https://prod-28.centralus.logic.azure.com:443/workflows/....` teruggee. Nou kan ons dit uitvoer met:
```bash
curl --request POST \
--url "https://prod-28.centralus.logic.azure.com:443/workflows/<workflow_id>/triggers/<trigger_name>/paths/invoke?api-version=2019-05-01&sp=%2Ftriggers%2F<trigger_name>%2Frun&sv=1.0&sig=<signature>" \
--header 'Content-Type: application/json' \
--data '{"exampleKey": "exampleValue"}'
```
### (`Microsoft.Web/sites/read`, `Microsoft.Web/sites/basicPublishingCredentialsPolicies/read`, `Microsoft.Web/sites/write`, `Microsoft.Web/sites/config/list/action`) && (`Microsoft.Web/sites/start/action`)
Met hierdie toestemmings kan jy Logic App werkvloei ontplooi deur ZIP-lêer ontplooiing. Hierdie toestemmings stel aksies in staat soos om app besonderhede te lees, toegang tot publikasie geloofsbriewe te verkry, veranderinge te skryf, en app konfigurasies te lys. Saam met die begin toestemmings kan jy 'n nuwe Logic App opdateer en ontplooi met die verlangde inhoud.
```bash
az logicapp deployment source config-zip \
--name <logic_app_name> \
--resource-group <resource_group_name> \
--src <path_to_zip_file>
```
{{#include ../../../banners/hacktricks-training.md}}
