gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-01-07 02:03:45 -08:00
Code Issues Packages Projects Releases Wiki Activity

fix

Browse Source
This commit is contained in:
Carlos Polop
2025-02-17 19:25:37 +01:00
parent 2505aec847
commit 0f7175eb98
3 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/pentesting-cloud/azure-security/az-privilege-escalation/az-servicebus-privesc.md
View File

@@ -99,7 +99,7 @@ az servicebus namespace update --disable-local-auth false -n <namespace-name> --
### Send Messages with keys (Microsoft.ServiceBus/namespaces/authorizationRules/listkeys/action OR Microsoft.ServiceBus/namespaces/authorizationRules/regenerateKeys/action)
You can retrieve the `PrimaryConnectionString`, which acts as a credential for the Service Bus namespace. With this connection string, you can fully authenticate as the Service Bus namespace, enabling you to send messages to any queue or topic and potentially interact with the system in ways that could disrupt operations, impersonate valid users, or inject malicious data into the messaging workflow. This method works if `--disable-local-auth` is set to false.
You can retrieve the `PrimaryConnectionString`, which acts as a credential for the Service Bus namespace. With this connection string, you can fully authenticate as the Service Bus namespace, enabling you to send messages to any queue or topic and potentially interact with the system in ways that could disrupt operations, impersonate valid users, or inject malicious data into the messaging workflow. This method works if `--disable-local-auth` is set to false (so local auth is enabled).
```python
import asyncio
@@ -252,7 +252,7 @@ from azure.servicebus.aio import ServiceBusClient
from azure.servicebus import ServiceBusMessage
NS = "<namespace>.servicebus.windows.net" # Your namespace
QUEUE_OR_TOPIC = "<QUEUE_OR_TOPIC>" # Your queue name
QUEUE_OR_TOPIC = "<QUEUE_OR_TOPIC>" # Your queue name
async def run():
credential = DefaultAzureCredential()