mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2026-07-28 22:51:09 -07:00
Translated ['.github/pull_request_template.md', 'src/pentesting-cloud/az
This commit is contained in:
Translator
@@ -4,99 +4,99 @@
|
||||
|
||||
## Basic Information
|
||||
|
||||
**Azure Function Apps** are a **serverless compute service** that allow you to run small pieces of code, called **functions**, without managing the underlying infrastructure. They are designed to execute code in response to various triggers, such as **HTTP requests, timers, or events from other Azure services** like Blob Storage or Event Hubs. Function Apps support multiple programming languages, including C#, Python, JavaScript, and Java, making them versatile for building **event-driven applications**, automating workflows, or integrating services. They are cost-effective, as you usually only pay for the compute time used when your code runs.
|
||||
**Azure Function Apps** ni **huduma ya kompyuta isiyo na seva** inayokuruhusu kuendesha vipande vidogo vya msimbo, vinavyojulikana kama **functions**, bila kusimamia miundombinu ya chini. Zimeundwa kutekeleza msimbo kama jibu kwa vichocheo mbalimbali, kama vile **maombi ya HTTP, muda, au matukio kutoka kwa huduma nyingine za Azure** kama Blob Storage au Event Hubs. Function Apps zinasaidia lugha nyingi za programu, ikiwa ni pamoja na C#, Python, JavaScript, na Java, na kuifanya kuwa rahisi kwa kujenga **maombi yanayoendeshwa na matukio**, kuendesha michakato, au kuunganisha huduma. Ni za gharama nafuu, kwani kwa kawaida unalipa tu kwa muda wa kompyuta ulitumika wakati msimbo wako unakimbia.
|
||||
|
||||
> [!NOTE]
|
||||
> Note that **Functions are a subset of the App Services**, therefore, a lot of the features discussed here will be used also by applications created as Azure Apps (`webapp` in cli).
|
||||
> Kumbuka kwamba **Functions ni sehemu ya App Services**, kwa hivyo, nyingi ya vipengele vilivyojadiliwa hapa vitatumika pia na maombi yaliyoundwa kama Azure Apps (`webapp` katika cli).
|
||||
|
||||
### Different Plans
|
||||
|
||||
- **Flex Consumption Plan**: Offers **dynamic, event-driven scaling** with pay-as-you-go pricing, adding or removing function instances based on demand. It supports **virtual networking** and **pre-provisioned instances** to reduce cold starts, making it suitable for **variable workloads** that don’t require container support.
|
||||
- **Traditional Consumption Plan**: The default serverless option, where you **pay only for compute resources when functions run**. It automatically scales based on incoming events and includes **cold start optimizations**, but does not support container deployments. Ideal for **intermittent workloads** requiring automatic scaling.
|
||||
- **Premium Plan**: Designed for **consistent performance**, with **prewarmed workers** to eliminate cold starts. It offers **extended execution times, virtual networking**, and supports **custom Linux images**, making it perfect for **mission-critical applications** needing high performance and advanced features.
|
||||
- **Dedicated Plan**: Runs on dedicated virtual machines with **predictable billing** and supports manual or automatic scaling. It allows running multiple apps on the same plan, provides **compute isolation**, and ensures **secure network access** via App Service Environments, making it ideal for **long-running applications** needing consistent resource allocation.
|
||||
- **Container Apps**: Enables deploying **containerized function apps** in a managed environment, alongside microservices and APIs. It supports custom libraries, legacy app migration, and **GPU processing**, eliminating Kubernetes cluster management. Ideal for **event-driven, scalable containerized applications**.
|
||||
- **Flex Consumption Plan**: Inatoa **kupanua kwa njia ya matukio, inayoweza kubadilika** na bei ya kulipa kadri unavyotumia, kuongeza au kuondoa mifano ya kazi kulingana na mahitaji. Inasaidia **mtandao wa virtual** na **mifano iliyotayarishwa awali** ili kupunguza kuanza baridi, na kuifanya kuwa bora kwa **mizigo inayobadilika** ambayo haitahitaji msaada wa kontena.
|
||||
- **Traditional Consumption Plan**: Chaguo la seva isiyo na msingi, ambapo unalipa tu kwa rasilimali za kompyuta wakati kazi zinakimbia. Inapanuka kiotomatiki kulingana na matukio yanayoingia na inajumuisha **mipango ya kuanza baridi**, lakini haisaidii kutekeleza kontena. Ni bora kwa **mizigo ya muda mfupi** inayohitaji kupanuka kiotomatiki.
|
||||
- **Premium Plan**: Imeundwa kwa ajili ya **utendaji thabiti**, ikiwa na **wafanyakazi walioandaliwa awali** ili kuondoa kuanza baridi. Inatoa **nyakati za utekelezaji zilizopanuliwa, mtandao wa virtual**, na inasaidia **picha za Linux za kawaida**, na kuifanya kuwa bora kwa **maombi muhimu** yanayohitaji utendaji wa juu na vipengele vya juu.
|
||||
- **Dedicated Plan**: Inakimbia kwenye mashine halisi zilizotengwa na **kodi inayoweza kutabiriwa** na inasaidia kupanuka kwa mikono au kiotomatiki. Inaruhusu kuendesha maombi mengi kwenye mpango mmoja, inatoa **kujitegemea kwa kompyuta**, na inahakikisha **ufikiaji salama wa mtandao** kupitia Mazingira ya Huduma ya Programu, na kuifanya kuwa bora kwa **maombi yanayoendelea kwa muda mrefu** yanayohitaji ugawaji wa rasilimali thabiti.
|
||||
- **Container Apps**: Inaruhusu kutekeleza **maombi ya kazi yaliyowekwa kwenye kontena** katika mazingira yanayosimamiwa, pamoja na huduma ndogo na APIs. Inasaidia maktaba za kawaida, uhamishaji wa maombi ya zamani, na **usindikaji wa GPU**, ikiondoa usimamizi wa klasta za Kubernetes. Ni bora kwa **maombi yanayoendeshwa na matukio, yanayoweza kupanuka yaliyowekwa kwenye kontena**.
|
||||
|
||||
### **Storage Buckets**
|
||||
|
||||
When creating a new Function App not containerised (but giving the code to run), the **code and other Function related data will be stored in a Storage account**. By default the web console will create a new one per function to store the code.
|
||||
Unapounda Function App mpya isiyo na kontena (lakini ukitoa msimbo wa kuendesha), **msimbo na data nyingine zinazohusiana na Function zitawekwa kwenye akaunti ya Hifadhi**. Kwa kawaida, console ya wavuti itaunda mpya kwa kila kazi kuhifadhi msimbo.
|
||||
|
||||
Moreover, modifying the code inside the bucket (in the different formats it could be stored), the **code of the app will be modified to the new one and executed** next time the Function is called.
|
||||
Zaidi ya hayo, kubadilisha msimbo ndani ya ndoo (katika mifumo tofauti ambayo inaweza kuhifadhiwa), **msimbo wa programu utabadilishwa kuwa mpya na kutekelezwa** wakati wa pili kazi inaitwa.
|
||||
|
||||
> [!CAUTION]
|
||||
> This is very interesting from an attackers perspective as **write access over this bucket** will allow an attacker to **compromise the code and escalate privileges** to the managed identities inside the Function App.
|
||||
> Hii ni ya kuvutia sana kutoka kwa mtazamo wa washambuliaji kwani **ufikiaji wa kuandika kwenye ndoo hii** utamruhusu mshambuliaji **kushambulia msimbo na kupandisha mamlaka** kwa vitambulisho vilivyo ndani ya Function App.
|
||||
>
|
||||
> More on this in the **privilege escalation section**.
|
||||
> Zaidi kuhusu hili katika **sehemu ya kupandisha mamlaka**.
|
||||
|
||||
It's also possible to find the **master and functions keys** stored in the storage account in the container **`azure-webjobs-secrets`** inside the folder **`<app-name>`** in the JSON files you can find inside.
|
||||
Pia inawezekana kupata **funguo za master na functions** zilizohifadhiwa katika akaunti ya hifadhi katika kontena **`azure-webjobs-secrets`** ndani ya folda **`<app-name>`** katika faili za JSON ambazo unaweza kupata ndani.
|
||||
|
||||
Note that Functions also allow to store the code in a remote location just indicating the URL to it.
|
||||
Kumbuka kwamba Functions pia zinaruhusu kuhifadhi msimbo katika eneo la mbali kwa kuashiria tu URL yake.
|
||||
|
||||
### Networking
|
||||
|
||||
Using a HTTP trigger:
|
||||
Kwa kutumia kichocheo cha HTTP:
|
||||
|
||||
- It's possible to give **access to a function to from all Internet** without requiring any authentication or give access IAM based. Although it’s also possible to restrict this access.
|
||||
- It's also possible to **give or restrict access** to a Function App from **an internal network (VPC)**.
|
||||
- Inawezekana kutoa **ufikiaji kwa kazi kutoka kwa Intaneti yote** bila kuhitaji uthibitisho wowote au kutoa ufikiaji wa msingi wa IAM. Ingawa pia inawezekana kuzuia ufikiaji huu.
|
||||
- Pia inawezekana **kutoa au kuzuia ufikiaji** kwa Function App kutoka **mtandao wa ndani (VPC)**.
|
||||
|
||||
> [!CAUTION]
|
||||
> This is very interesting from an attackers perspective as it might be possible to **pivot to internal networks** from a vulnerable Function exposed to the Internet.
|
||||
> Hii ni ya kuvutia sana kutoka kwa mtazamo wa washambuliaji kwani inaweza kuwa inawezekana **kuhamasisha kwenye mitandao ya ndani** kutoka kwa Function dhaifu iliyo wazi kwa Intaneti.
|
||||
|
||||
### **Function App Settings & Environment Variables**
|
||||
|
||||
It's possible to configure environment variables inside an app, which could contain sensitive information. Moreover, by default the env variables **`AzureWebJobsStorage`** and **`WEBSITE_CONTENTAZUREFILECONNECTIONSTRING`** (among others) are created. These are specially interesting because they **contain the account key to control with FULL permissions the storage account containing the data of the application**. These settings are also needed to execute the code from the Storage Account.
|
||||
Inawezekana kuunda mabadiliko ya mazingira ndani ya programu, ambayo yanaweza kuwa na taarifa nyeti. Zaidi ya hayo, kwa kawaida mabadiliko ya mazingira **`AzureWebJobsStorage`** na **`WEBSITE_CONTENTAZUREFILECONNECTIONSTRING`** (miongoni mwa mengine) yanaundwa. Haya ni ya kuvutia sana kwa sababu yana **funguo za akaunti kudhibiti kwa MAMLAKA KAMILI akaunti ya hifadhi inayoshikilia data ya programu**. Mipangilio hii pia inahitajika kutekeleza msimbo kutoka kwa Akaunti ya Hifadhi.
|
||||
|
||||
These env variables or configuration parameters also controls how the Function execute the code, for example if **`WEBSITE_RUN_FROM_PACKAGE`** exists, it'll indicate the URL where the code of the application is located.
|
||||
Mabadiliko haya ya mazingira au vigezo vya usanidi pia vinadhibiti jinsi Function inavyotekeleza msimbo, kwa mfano ikiwa **`WEBSITE_RUN_FROM_PACKAGE`** ipo, itadhihirisha URL ambapo msimbo wa programu unapatikana.
|
||||
|
||||
### **Function Sandbox**
|
||||
|
||||
Inside the linux sandbox the source code is located in **`/home/site/wwwroot`** in the file **`function_app.py`** (if python is used) the user running the code is **`app`** (without sudo permissions).
|
||||
Ndani ya sandbox ya linux, msimbo wa chanzo unapatikana katika **`/home/site/wwwroot`** katika faili **`function_app.py`** (ikiwa python inatumika) mtumiaji anayekimbia msimbo ni **`app`** (bila ruhusa za sudo).
|
||||
|
||||
In a **Windows** function using NodeJS the code was located in **`C:\home\site\wwwroot\HttpTrigger1\index.js`**, the username was **`mawsFnPlaceholder8_f_v4_node_20_x86`** and was part of the **groups**: `Mandatory Label\High Mandatory Level Label`, `Everyone`, `BUILTIN\Users`, `NT AUTHORITY\INTERACTIVE`, `CONSOLE LOGON`, `NT AUTHORITY\Authenticated Users`, `NT AUTHORITY\This Organization`, `BUILTIN\IIS_IUSRS`, `LOCAL`, `10-30-4-99\Dwas Site Users`.
|
||||
Katika **Windows** function inayotumia NodeJS msimbo ulikuwa unapatikana katika **`C:\home\site\wwwroot\HttpTrigger1\index.js`**, jina la mtumiaji lilikuwa **`mawsFnPlaceholder8_f_v4_node_20_x86`** na ilikuwa sehemu ya **makundi**: `Mandatory Label\High Mandatory Level Label`, `Everyone`, `BUILTIN\Users`, `NT AUTHORITY\INTERACTIVE`, `CONSOLE LOGON`, `NT AUTHORITY\Authenticated Users`, `NT AUTHORITY\This Organization`, `BUILTIN\IIS_IUSRS`, `LOCAL`, `10-30-4-99\Dwas Site Users`.
|
||||
|
||||
### **Managed Identities & Metadata**
|
||||
|
||||
Just like [**VMs**](vms/), Functions can have **Managed Identities** of 2 types: System assigned and User assigned.
|
||||
Kama [**VMs**](vms/), Functions zinaweza kuwa na **Managed Identities** za aina 2: Iliyotolewa na Mfumo na Iliyotolewa na Mtumiaji.
|
||||
|
||||
The **system assigned** one will be a managed identity that **only the function** that has it assigned would be able to use, while the **user assigned** managed identities are managed identities that **any other Azure service will be able to use**.
|
||||
**iliyotolewa na mfumo** itakuwa ni kitambulisho kinachoweza kusimamiwa ambacho **ni kazi pekee** ambayo ina kitambulisho hicho itakuwa na uwezo wa kutumia, wakati **iliyotolewa na mtumiaji** ni vitambulisho vinavyoweza kusimamiwa ambavyo **huduma nyingine yoyote ya Azure itakuwa na uwezo wa kutumia**.
|
||||
|
||||
> [!NOTE]
|
||||
> Just like in [**VMs**](vms/), Functions can have **1 system assigned** managed identity and **several user assigned** ones, so it's always important to try to find all of them if you compromise the function because you might be able to escalate privileges to several managed identities from just one Function.
|
||||
> Kama ilivyo katika [**VMs**](vms/), Functions zinaweza kuwa na **1 kitambulisho kilichotolewa na mfumo** na **vitambulisho vingi vilivyotolewa na mtumiaji**, kwa hivyo ni muhimu kila wakati kujaribu kupata vyote ikiwa unashambulia kazi kwa sababu unaweza kuwa na uwezo wa kupandisha mamlaka kwa vitambulisho vingi vilivyotolewa kutoka kwa Function moja tu.
|
||||
>
|
||||
> If a no system managed identity is used but one or more user managed identities are attached to a function, by default you won’t be able to get any token.
|
||||
> Ikiwa kitambulisho kisichotolewa na mfumo hakitumiki lakini kitambulisho kimoja au zaidi kilichotolewa na mtumiaji kimeunganishwa na kazi, kwa kawaida huwezi kupata token yoyote.
|
||||
|
||||
It's possible to use the [**PEASS scripts**](https://github.com/peass-ng/PEASS-ng) to get tokens from the default managed identity from the metadata endpoint. Or you could get them **manually** as explained in:
|
||||
Inawezekana kutumia [**PEASS scripts**](https://github.com/peass-ng/PEASS-ng) kupata token kutoka kwa kitambulisho kilichotolewa na mfumo kutoka kwa kiunganishi cha metadata. Au unaweza kuyapata **kwa mikono** kama ilivyoelezwa katika:
|
||||
|
||||
{% embed url="https://book.hacktricks.xyz/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf#azure-vm" %}
|
||||
|
||||
Note that you need to find out a way to **check all the Managed Identities a function has attached** as if you don't indicate it, the metadata endpoint will **only use the default one** (check the previous link for more info).
|
||||
Kumbuka kwamba unahitaji kupata njia ya **kuangalia vitambulisho vyote vilivyotolewa na kazi** kama hujaashiria, kiunganishi cha metadata kita **tumia tu kile cha kawaida** (angalia kiungo kilichopita kwa maelezo zaidi).
|
||||
|
||||
## Access Keys
|
||||
|
||||
> [!NOTE]
|
||||
> Note that there aren't RBAC permissions to give access to users to invoke the functions. The **function invocation depends on the trigger** selected when it was created and if a HTTP Trigger was selected, it might be needed to use an **access key**.
|
||||
> Kumbuka kwamba hakuna ruhusa za RBAC za kutoa ufikiaji kwa watumiaji kuanzisha kazi. **kuanzisha kazi kunategemea kichocheo** kilichochaguliwa wakati ilipoundwa na ikiwa kichocheo cha HTTP kilichaguliwa, inaweza kuwa inahitajika kutumia **funguo za ufikiaji**.
|
||||
|
||||
When creating an endpoint inside a function using a **HTTP trigger** it's possible to indicate the **access key authorization level** needed to trigger the function. Three options are available:
|
||||
Unapounda kiunganishi ndani ya kazi kwa kutumia **kichocheo cha HTTP** inawezekana kuashiria **ngazi ya idhini ya funguo za ufikiaji** inayohitajika kuanzisha kazi. Chaguzi tatu zinapatikana:
|
||||
|
||||
- **ANONYMOUS**: **Everyone** can access the function by the URL.
|
||||
- **FUNCTION**: Endpoint is only accessible to users using a **function, host or master key**.
|
||||
- **ADMIN**: Endpoint is only accessible to users a **master key**.
|
||||
- **ANONYMOUS**: **Kila mtu** anaweza kufikia kazi kupitia URL.
|
||||
- **FUNCTION**: Kiunganishi kinapatikana tu kwa watumiaji wanaotumia **funguo, mwenyeji au funguo za master**.
|
||||
- **ADMIN**: Kiunganishi kinapatikana tu kwa watumiaji wenye **funguo za master**.
|
||||
|
||||
**Type of keys:**
|
||||
**Aina za funguo:**
|
||||
|
||||
- **Function Keys:** Function keys can be either default or user-defined and are designed to grant access exclusively to **specific function endpoints** within a Function App allowing a more fine-grained access over the endpoints.
|
||||
- **Host Keys:** Host keys, which can also be default or user-defined, provide access to **all function endpoints within a Function App with FUNCTION access level**.
|
||||
- **Master Key:** The master key (`_master`) serves as an administrative key that offers elevated permissions, including access to all function endpoints (ADMIN access lelvel included). This **key cannot be revoked.**
|
||||
- **System Keys:** System keys are **managed by specific extensions** and are required for accessing webhook endpoints used by internal components. Examples include the Event Grid trigger and Durable Functions, which utilize system keys to securely interact with their respective APIs.
|
||||
- **Funguo za Kazi:** Funguo za kazi zinaweza kuwa za kawaida au zilizofanywa na mtumiaji na zimeundwa kutoa ufikiaji pekee kwa **kiunganishi maalum cha kazi** ndani ya Function App ikiruhusu ufikiaji wa kina zaidi juu ya viunganishi.
|
||||
- **Funguo za Mwenyeji:** Funguo za mwenyeji, ambazo pia zinaweza kuwa za kawaida au zilizofanywa na mtumiaji, zinatoa ufikiaji kwa **viunganishi vyote vya kazi ndani ya Function App na ngazi ya ufikiaji wa FUNCTION**.
|
||||
- **Funguo za Master:** Funguo za master (`_master`) hutumikia kama funguo za usimamizi zinazotoa ruhusa za juu, ikiwa ni pamoja na ufikiaji kwa viunganishi vyote vya kazi (ngazi ya ufikiaji wa ADMIN inajumuishwa). **Funguo hii haiwezi kufutwa.**
|
||||
- **Funguo za Mfumo:** Funguo za mfumo zinazosimamiwa na **nyongeza maalum** na zinahitajika kwa ufikiaji wa viunganishi vya webhook vinavyotumiwa na vipengele vya ndani. Mifano ni pamoja na kichocheo cha Event Grid na Functions za Kudumu, ambazo hutumia funguo za mfumo kuingiliana kwa usalama na APIs zao.
|
||||
|
||||
> [!TIP]
|
||||
> Example to access a function API endpoint using a key:
|
||||
> Mfano wa kufikia kiunganishi cha API ya kazi kwa kutumia funguo:
|
||||
>
|
||||
> `https://<function_uniq_name>.azurewebsites.net/api/<endpoint_name>?code=<access_key>`
|
||||
|
||||
### Basic Authentication
|
||||
|
||||
Just like in App Services, Functions also support basic authentication to connect to **SCM** and **FTP** to deploy code using a **username and password in a URL** provided by Azure. More information about it in:
|
||||
Kama ilivyo katika App Services, Functions pia zinasaidia uthibitishaji wa msingi kuungana na **SCM** na **FTP** ili kutekeleza msimbo kwa kutumia **jina la mtumiaji na nenosiri katika URL** inayotolewa na Azure. Maelezo zaidi kuhusu hilo katika:
|
||||
|
||||
{{#ref}}
|
||||
az-app-service.md
|
||||
@@ -104,12 +104,11 @@ az-app-service.md
|
||||
|
||||
### Github Based Deployments
|
||||
|
||||
When a function is generated from a Github repo Azure web console allows to **automatically create a Github Workflow in a specific repository** so whenever this repository is updated the code of the function is updated. Actually the Github Action yaml for a python function looks like this:
|
||||
Wakati kazi inaundwa kutoka kwa repo ya Github, console ya wavuti ya Azure inaruhusu **kuunda kiotomatiki Github Workflow katika hifadhi maalum** ili kila wakati hifadhi hii inaposasishwa, msimbo wa kazi unasasishwa. Kwa kweli, Github Action yaml kwa kazi ya python inaonekana kama ifuatavyo:
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Github Action Yaml</summary>
|
||||
|
||||
```yaml
|
||||
# Docs for the Azure Web Apps Deploy action: https://github.com/azure/functions-action
|
||||
# More GitHub Actions for Azure: https://github.com/Azure/actions
|
||||
@@ -118,95 +117,93 @@ When a function is generated from a Github repo Azure web console allows to **au
|
||||
name: Build and deploy Python project to Azure Function App - funcGithub
|
||||
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
workflow_dispatch:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
workflow_dispatch:
|
||||
|
||||
env:
|
||||
AZURE_FUNCTIONAPP_PACKAGE_PATH: "." # set this to the path to your web app project, defaults to the repository root
|
||||
PYTHON_VERSION: "3.11" # set this to the python version to use (supports 3.6, 3.7, 3.8)
|
||||
AZURE_FUNCTIONAPP_PACKAGE_PATH: "." # set this to the path to your web app project, defaults to the repository root
|
||||
PYTHON_VERSION: "3.11" # set this to the python version to use (supports 3.6, 3.7, 3.8)
|
||||
|
||||
jobs:
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
build:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Setup Python version
|
||||
uses: actions/setup-python@v5
|
||||
with:
|
||||
python-version: ${{ env.PYTHON_VERSION }}
|
||||
- name: Setup Python version
|
||||
uses: actions/setup-python@v5
|
||||
with:
|
||||
python-version: ${{ env.PYTHON_VERSION }}
|
||||
|
||||
- name: Create and start virtual environment
|
||||
run: |
|
||||
python -m venv venv
|
||||
source venv/bin/activate
|
||||
- name: Create and start virtual environment
|
||||
run: |
|
||||
python -m venv venv
|
||||
source venv/bin/activate
|
||||
|
||||
- name: Install dependencies
|
||||
run: pip install -r requirements.txt
|
||||
- name: Install dependencies
|
||||
run: pip install -r requirements.txt
|
||||
|
||||
# Optional: Add step to run tests here
|
||||
# Optional: Add step to run tests here
|
||||
|
||||
- name: Zip artifact for deployment
|
||||
run: zip release.zip ./* -r
|
||||
- name: Zip artifact for deployment
|
||||
run: zip release.zip ./* -r
|
||||
|
||||
- name: Upload artifact for deployment job
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: python-app
|
||||
path: |
|
||||
release.zip
|
||||
!venv/
|
||||
- name: Upload artifact for deployment job
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: python-app
|
||||
path: |
|
||||
release.zip
|
||||
!venv/
|
||||
|
||||
deploy:
|
||||
runs-on: ubuntu-latest
|
||||
needs: build
|
||||
deploy:
|
||||
runs-on: ubuntu-latest
|
||||
needs: build
|
||||
|
||||
permissions:
|
||||
id-token: write #This is required for requesting the JWT
|
||||
permissions:
|
||||
id-token: write #This is required for requesting the JWT
|
||||
|
||||
steps:
|
||||
- name: Download artifact from build job
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: python-app
|
||||
steps:
|
||||
- name: Download artifact from build job
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: python-app
|
||||
|
||||
- name: Unzip artifact for deployment
|
||||
run: unzip release.zip
|
||||
- name: Unzip artifact for deployment
|
||||
run: unzip release.zip
|
||||
|
||||
- name: Login to Azure
|
||||
uses: azure/login@v2
|
||||
with:
|
||||
client-id: ${{ secrets.AZUREAPPSERVICE_CLIENTID_6C3396368D954957BC58E4C788D37FD1 }}
|
||||
tenant-id: ${{ secrets.AZUREAPPSERVICE_TENANTID_7E50AEF6222E4C3DA9272D27FB169CCD }}
|
||||
subscription-id: ${{ secrets.AZUREAPPSERVICE_SUBSCRIPTIONID_905358F484A74277BDC20978459F26F4 }}
|
||||
- name: Login to Azure
|
||||
uses: azure/login@v2
|
||||
with:
|
||||
client-id: ${{ secrets.AZUREAPPSERVICE_CLIENTID_6C3396368D954957BC58E4C788D37FD1 }}
|
||||
tenant-id: ${{ secrets.AZUREAPPSERVICE_TENANTID_7E50AEF6222E4C3DA9272D27FB169CCD }}
|
||||
subscription-id: ${{ secrets.AZUREAPPSERVICE_SUBSCRIPTIONID_905358F484A74277BDC20978459F26F4 }}
|
||||
|
||||
- name: "Deploy to Azure Functions"
|
||||
uses: Azure/functions-action@v1
|
||||
id: deploy-to-function
|
||||
with:
|
||||
app-name: "funcGithub"
|
||||
slot-name: "Production"
|
||||
package: ${{ env.AZURE_FUNCTIONAPP_PACKAGE_PATH }}
|
||||
- name: "Deploy to Azure Functions"
|
||||
uses: Azure/functions-action@v1
|
||||
id: deploy-to-function
|
||||
with:
|
||||
app-name: "funcGithub"
|
||||
slot-name: "Production"
|
||||
package: ${{ env.AZURE_FUNCTIONAPP_PACKAGE_PATH }}
|
||||
```
|
||||
|
||||
</details>
|
||||
|
||||
Moreover, a **Managed Identity** is also created so the Github Action from the repository will be able to login into Azure with it. This is done by generating a Federated credential over the **Managed Identity** allowing the **Issuer** `https://token.actions.githubusercontent.com` and the **Subject Identifier** `repo:<org-name>/<repo-name>:ref:refs/heads/<branch-name>`.
|
||||
Zaidi ya hayo, **Identiti Iliyosimamiwa** pia inaundwa ili Github Action kutoka kwenye hazina iweze kuingia kwenye Azure kwa kutumia hiyo. Hii inafanywa kwa kuzalisha akidi ya Shirikisho juu ya **Identiti Iliyosimamiwa** ikiruhusu **Mtoaji** `https://token.actions.githubusercontent.com` na **Kitambulisho cha Kichwa** `repo:<org-name>/<repo-name>:ref:refs/heads/<branch-name>`.
|
||||
|
||||
> [!CAUTION]
|
||||
> Therefore, anyone compromising that repo will be able to compromise the function and the Managed Identities attached to it.
|
||||
> Hivyo basi, mtu yeyote anayekatisha tamaa hazina hiyo ataweza kukatisha tamaa kazi na Identiti Iliyosimamiwa zinazohusiana nayo.
|
||||
|
||||
### Container Based Deployments
|
||||
### Utekelezaji wa Msingi wa Kontena
|
||||
|
||||
Not all the plans allow to deploy containers, but for the ones that do, the configuration will contain the URL of the container. In the API the **`linuxFxVersion`** setting will ha something like: `DOCKER|mcr.microsoft.com/...`, while in the web console, the configuration will show the **image settings**.
|
||||
Sio mipango yote inayo ruhusu kutekeleza kontena, lakini kwa zile zinazofanya hivyo, usanidi utaonyesha URL ya kontena. Katika API, mipangilio ya **`linuxFxVersion`** itakuwa na kitu kama: `DOCKER|mcr.microsoft.com/...`, wakati katika console ya wavuti, usanidi utaonyesha **mipangilio ya picha**.
|
||||
|
||||
Moreover, **no source code will be stored in the storage** account related to the function as it's not needed.
|
||||
|
||||
## Enumeration
|
||||
Zaidi ya hayo, **hakuna msimbo wa chanzo utakaohifadhiwa katika akaunti ya hifadhi** inayohusiana na kazi kwani haitahitajika.
|
||||
|
||||
## Uainishaji
|
||||
```bash
|
||||
# List all the functions
|
||||
az functionapp list
|
||||
@@ -218,15 +215,15 @@ az functionapp show --name <app-name> --resource-group <res-group>
|
||||
|
||||
# Get details about the source of the function code
|
||||
az functionapp deployment source show \
|
||||
--name <app-name> \
|
||||
--resource-group <res-group>
|
||||
--name <app-name> \
|
||||
--resource-group <res-group>
|
||||
## If error like "This is currently not supported."
|
||||
## Then, this is probalby using a container
|
||||
|
||||
# Get more info if a container is being used
|
||||
az functionapp config container show \
|
||||
--name <name> \
|
||||
--resource-group <res-group>
|
||||
--name <name> \
|
||||
--resource-group <res-group>
|
||||
|
||||
# Get settings (and privesc to the sorage account)
|
||||
az functionapp config appsettings list --name <app-name> --resource-group <res-group>
|
||||
@@ -242,7 +239,7 @@ az functionapp config access-restriction show --name <app-name> --resource-group
|
||||
|
||||
# Get more info about a function (invoke_url_template is the URL to invoke and script_href allows to see the code)
|
||||
az rest --method GET \
|
||||
--url "https://management.azure.com/subscriptions/<subscription>/resourceGroups/<res-group>/providers/Microsoft.Web/sites/<app-name>/functions?api-version=2024-04-01"
|
||||
--url "https://management.azure.com/subscriptions/<subscription>/resourceGroups/<res-group>/providers/Microsoft.Web/sites/<app-name>/functions?api-version=2024-04-01"
|
||||
|
||||
# Get source code with Master Key of the function
|
||||
curl "<script_href>?code=<master-key>"
|
||||
@@ -252,19 +249,14 @@ curl "https://newfuncttest123.azurewebsites.net/admin/vfs/home/site/wwwroot/func
|
||||
# Get source code
|
||||
az rest --url "https://management.azure.com/<subscription>/resourceGroups/<res-group>/providers/Microsoft.Web/sites/<app-name>/hostruntime/admin/vfs/function_app.py?relativePath=1&api-version=2022-03-01"
|
||||
```
|
||||
|
||||
## Privilege Escalation
|
||||
## Kuinua Mamlaka
|
||||
|
||||
{{#ref}}
|
||||
../az-privilege-escalation/az-functions-app-privesc.md
|
||||
{{#endref}}
|
||||
|
||||
## References
|
||||
## Marejeo
|
||||
|
||||
- [https://learn.microsoft.com/en-us/azure/azure-functions/functions-openapi-definition](https://learn.microsoft.com/en-us/azure/azure-functions/functions-openapi-definition)
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
Reference in New Issue
Block a user