Translated ['', 'src/pentesting-cloud/azure-security/az-privilege-escala

src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/dynamic-groups.md

@@ -2,27 +2,59 @@
 
 {{#include ../../../../banners/hacktricks-training.md}}
 
-## Basic Information
+## Taarifa za Msingi
 
-**Dynamic groups** ni vikundi ambavyo vina seti ya **rules** zilizowekwa na watumiaji wote au **devices** wanaolingana na sheria hizo wanaongezwa kwenye kundi. Kila wakati **attribute** ya mtumiaji au kifaa inapo **badilishwa**, sheria za dynamic zinarejelewa. Na wakati **sheria mpya** inapo **undwa**, vifaa vyote na watumiaji vinakaguliwa.
+**Dynamic groups** ni vikundi vinavyokuwa na seti ya **rules** zilizosanidiwa na wote **users or devices** vinavyokidhi rules hizi huongezwa kwenye kundi. Kila wakati sifa za mtumiaji au kifaa (**attribute**) zinapobadilika, rules za dynamic huangaliwa tena. Na wakati **new rule** inapotengenezwa, vifaa na watumiaji wote huangaliwa.
 
-Vikundi vya dynamic vinaweza kuwa na **Azure RBAC roles** zilizotolewa kwao, lakini **haiwezekani** kuongeza **AzureAD roles** kwenye vikundi vya dynamic.
+Dynamic groups zinaweza kuwa na **Azure RBAC roles assigned** kwao, lakini haiwezekani kuongeza **AzureAD roles** kwenye dynamic groups.
 
-Kipengele hiki kinahitaji leseni ya Azure AD premium P1.
+Kipengele hiki kinahitaji Azure AD premium P1 license.
 
 ## Privesc
 
-Kumbuka kwamba kwa default mtumiaji yeyote anaweza kuwalika wageni katika Azure AD, hivyo, ikiwa sheria ya kundi la dynamic inatoa **permissions** kwa watumiaji kulingana na **attributes** ambazo zinaweza **kuwekwa** kwa **mgeni** mpya, inawezekana **kuunda mgeni** mwenye attributes hizi na **kuinua mamlaka**. Pia inawezekana kwa mgeni kusimamia wasifu wake mwenyewe na kubadilisha attributes hizi.
+Kumbuka kuwa kwa chaguo-msingi mtumiaji yeyote anaweza kualika **guests** katika Azure AD, hivyo, ikiwa rule ya dynamic group inawapa watumiaji **permissions** kulingana na **attributes** ambazo zinaweza kuwekewa **guest** mpya, inawezekana **kuunda guest** mwenye attributes hizi na **escalate privileges**. Pia guest anaweza kusimamia wasifu wake mwenyewe na kubadilisha attributes hizi.
 
-Pata vikundi vinavyoruhusu Uanachama wa Dynamic: **`az ad group list --query "[?contains(groupTypes, 'DynamicMembership')]" --output table`**
+Pata vikundi vinavyoruhusu Dynamic membership: **`az ad group list --query "[?contains(groupTypes, 'DynamicMembership')]" --output table`**
 
-### Example
+### Dynamic Groups Enumeration
 
-- **Rule example**: `(user.otherMails -any (_ -contains "security")) -and (user.userType -eq "guest")`
-- **Rule description**: Mtumiaji yeyote wa Mgeni mwenye barua pepe ya pili yenye maandiko 'security' ataongezwa kwenye kundi
+Pata rules za dynamic group:
 
-Kwa barua pepe ya mtumiaji wa Mgeni, kubali mwaliko na angalia mipangilio ya **mtumiaji huyo** katika [https://entra.microsoft.com/#view/Microsoft_AAD_IAM/TenantOverview.ReactView](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/TenantOverview.ReactView).\
-Kwa bahati mbaya, ukurasa haukuruhusu kubadilisha thamani za attribute hivyo tunahitaji kutumia API:
+Kwa **Azure CLI**:
+```bash
+az ad group list \
+--filter "groupTypes/any(c:c eq 'DynamicMembership')" \
+--query "[].{displayName:displayName, rule:membershipRule}" \
+-o table
+```
+Kwa **PowerShell** na **Microsoft Graph SDK**:
+```bash
+Install-Module Microsoft.Graph -Scope CurrentUser -Force
+Import-Module Microsoft.Graph
+
+Connect-MgGraph -Scopes "Group.Read.All"
+
+Get-MgGroup -Filter "groupTypes/any(c:c eq 'DynamicMembership')" `
+-Property Id, DisplayName, GroupTypes
+
+# Get the rules of a specific group
+$g = Get-MgGroup -Filter "displayName eq '<GROUP NAME>'" `
+-Property DisplayName, GroupTypes, MembershipRule, MembershipRuleProcessingState
+
+$g | Select-Object DisplayName, GroupTypes, MembershipRule
+
+# Get the rules of all dynamic groups
+Get-MgGroup -Filter "groupTypes/any(c:c eq 'DynamicMembership')" `
+-Property DisplayName, MembershipRule |
+Select-Object DisplayName, MembershipRule
+```
+### Mfano
+
+- **Mfano wa kanuni**: `(user.otherMails -any (_ -contains "security")) -and (user.userType -eq "guest")`
+- **Maelezo ya kanuni**: Mtumiaji yeyote wa Guest ambaye ana barua-pepe ya pili inayojumuisha 'security' ataongezwa kwenye kundi
+
+Kwa barua-pepe ya mtumiaji Guest, kubali mualiko na angalia mipangilio ya sasa ya **mtumiaji huyo** katika [https://entra.microsoft.com/#view/Microsoft_AAD_IAM/TenantOverview.ReactView](https://entra.microsoft.com/#view/Microsoft_AAD_IAM/TenantOverview.ReactView).\
+Kwa bahati mbaya ukurasa haukuruhusu kubadilisha thamani za sifa, hivyo tunahitaji kutumia API:
 ```bash
 # Login with the gust user
 az login --allow-no-subscriptions
@@ -41,7 +73,7 @@ az rest --method GET \
 --url "https://graph.microsoft.com/v1.0/users/<user-object-id>" \
 --query "otherMails"
 ```
-## Marejeleo
+## Marejeo
 
 - [https://www.mnemonic.io/resources/blog/abusing-dynamic-groups-in-azure-ad-for-privilege-escalation/](https://www.mnemonic.io/resources/blog/abusing-dynamic-groups-in-azure-ad-for-privilege-escalation/)