translate half

2026-07-02 11:00:16 -07:00 · 2024-12-31 18:48:31 +01:00
parent 7770a50092
commit 4d622f5500
244 changed files with 245 additions and 0 deletions
@@ -67,3 +67,4 @@ This tool allows to perform several actions like register a machine in Azure AD



+
@@ -62,3 +62,4 @@ Get-ADSyncConnector



+
@@ -51,3 +51,4 @@ Check it in the original post: [https://dirkjanm.io/obtaining-domain-admin-from-



+
@@ -11,3 +11,4 @@ The blog post discusses a privilege escalation vulnerability in Azure AD, allowi



+
@@ -34,3 +34,4 @@ An automatically, this user will be **synced from AzureAD to the on-prem AD user



+
@@ -163,3 +163,4 @@ Open-AADIntOffice365Portal -ImmutableID "aodilmsic30fugCUgHxsnK==" -Issuer http:



+
@@ -124,3 +124,4 @@ seamless-sso.md



+
@@ -72,3 +72,4 @@ seamless-sso.md



+
@@ -119,3 +119,4 @@ python rbdel.py -u <workgroup>\\<user> -p <pass> <ip> azureadssosvc$



+
@@ -286,3 +286,4 @@ roadrecon auth --prt-cookie <cookie> --prt-context <context> --derives-key <deri



+
@@ -70,3 +70,4 @@ Open-AADIntOffice365Portal -ImmutableID qIMPTm2Q3kimHgg4KQyveA== -Issuer "http:/



+
@@ -33,3 +33,4 @@ az storage queue policy set --name <queue-name> --permissions rwd --expiry 2024-



+
@@ -43,3 +43,4 @@ az storage blob service-properties delete-policy update \



+
@@ -27,3 +27,4 @@ An attacker could get access to the instances and backdoor them:



+
@@ -4,3 +4,4 @@



+
@@ -47,3 +47,4 @@ This would allow to delete objects inside the storage account which might **inte



+
@@ -50,3 +50,4 @@ This would allow to delete file inside the shared filesystem which might **inter



+
@@ -19,3 +19,4 @@ For more information about function apps check:



+
@@ -113,3 +113,4 @@ az keyvault secret restore --vault-name <vault-name> --file <backup-file-path>



+
@@ -91,3 +91,4 @@ az storage queue policy set --name <queue-name> --permissions rwd --expiry 2024-



+
@@ -101,3 +101,4 @@ Take a look here:



+
@@ -104,3 +104,4 @@ az sql db import --admin-user <admin-user> \



+
@@ -66,3 +66,4 @@ This would allow to delete file inside the shared filesystem which might **inter



+
@@ -183,3 +183,4 @@ az vm application set \



+
@@ -4,3 +4,4 @@



+
@@ -41,3 +41,4 @@ ssh root@127.0.0.1 -p 39895



+
@@ -84,3 +84,4 @@ az rest --method PUT \



+
@@ -359,3 +359,4 @@ az rest --method GET \



+
@@ -183,3 +183,4 @@ $data = Get-SharePointFilesFromGraph -authentication $token $data[0].downloadUrl



+
@@ -52,3 +52,4 @@ az rest --method GET \



+
@@ -459,3 +459,4 @@ az functionapp deployment source config \



+
@@ -36,3 +36,4 @@ az keyvault set-policy \



+
@@ -75,3 +75,4 @@ az storage queue policy set --name <queue-name> --permissions rwd --expiry 2024-



+
@@ -156,3 +156,4 @@ az servicebus namespace authorization-rule update \



+
@@ -113,3 +113,4 @@ az sql server azure-ad-only-auth disable \



+
@@ -154,3 +154,4 @@ az storage share-rm restore \



+
@@ -384,3 +384,4 @@ According to the [**docs**](https://learn.microsoft.com/en-us/azure/role-based-a



+
@@ -75,3 +75,4 @@ def main(req: func.HttpRequest) -> func.HttpResponse:



+
@@ -54,3 +54,4 @@ docker pull <corp-name>.azurecr.io/<image>:<tag>



+
@@ -216,3 +216,4 @@ git clone 'https://<username>:<password>@name.scm.azurewebsites.net/repo-name.gi



+
@@ -42,3 +42,4 @@ Get-ApplicationProxyAssignedUsersAndGroups -ObjectId <object-id>



+
@@ -33,3 +33,4 @@ cat <PATH TO .json FILE> | Select-String password



+
@@ -180,3 +180,4 @@ $response = Invoke-WebRequest -Method Post -Uri $uri -Body $body



+
@@ -67,3 +67,4 @@ The successful execution of this process opens numerous possibilities for furthe



+
@@ -1033,3 +1033,4 @@ The default mode is **Audit**:



+
@@ -174,3 +174,4 @@ Same as storage persistence:



+
@@ -268,3 +268,4 @@ az rest --url "https://management.azure.com/<subscription>/resourceGroups/<res-g



+
@@ -71,3 +71,4 @@ Get-AzLogicApp -ResourceGroupName <ResourceGroupName> -Name <LogicAppName>



+
@@ -58,3 +58,4 @@ az group list --subscription "<subscription>" --output table



+
@@ -97,3 +97,4 @@ $queueMessage.Value



+
@@ -102,3 +102,4 @@ az servicebus namespace authorization-rule keys list --resource-group <MyResourc



+
@@ -263,3 +263,4 @@ sqlcmd -S <sql-server>.database.windows.net -U <server-user> -P <server-passwork



+
@@ -439,3 +439,4 @@ az-file-shares.md



+
@@ -111,3 +111,4 @@ Same as storage persistence:



+
@@ -33,3 +33,4 @@ The execution of the script can take up to **one hour**.



+
@@ -186,3 +186,4 @@ done



+
@@ -863,3 +863,4 @@ Invoke-AzureRmVMBulkCMD -Script Mimikatz.ps1 -Verbose -output Output.txt



+
@@ -466,3 +466,4 @@ Get-AzExpressRouteCircuit



+
@@ -250,3 +250,4 @@ az-password-spraying.md



+
@@ -9,3 +9,4 @@



+
@@ -153,3 +153,4 @@ Check the Applications and Service Principal sections of the page:



+
@@ -37,3 +37,4 @@ Invoke-PasswordSprayGmail -UserList .\userlist.txt -Password Fall2016 -Threads 1



+
@@ -43,3 +43,4 @@ az vm extension image list --publisher "Site24x7" --output table



+
@@ -45,3 +45,4 @@ do-services/



+
@@ -137,3 +137,4 @@ The **logs of a team** can be found in [**https://cloud.digitalocean.com/account



+
@@ -9,3 +9,4 @@ DO doesn't support granular permissions. So the **minimum role** that allows a u



+
@@ -21,3 +21,4 @@ DO offers a few services, here you can find how to **enumerate them:**



+
@@ -36,3 +36,4 @@ That will give you a **shell**, and just executing **`env`** you will be able to



+
@@ -35,3 +35,4 @@ doctl registry repository list-v2



+
@@ -45,3 +45,4 @@ doctl databases pool list <db-id> # List pools of DB



+
@@ -83,3 +83,4 @@ It's also possible to launch a **recovery console** to run commands inside the h



+
@@ -62,3 +62,4 @@ doctl serverless activations result <activation-id> # get only the response resu



+
@@ -21,3 +21,4 @@ doctl compute image list



+
@@ -41,3 +41,4 @@ doctl kubernetes cluster list-associated-resources <cluster-id>



+
@@ -47,3 +47,4 @@ doctl compute firewall remove-droplets <fw-id> --droplet-ids <droplet-id>



+
@@ -25,3 +25,4 @@ doctl projects resources list <proj-id> # Get all the resources of a project



+
@@ -48,3 +48,4 @@ aws s3 ls --endpoint=https://fra1.digitaloceanspaces.com s3://uniqbucketname



+
@@ -17,3 +17,4 @@ compute volume list



+
@@ -247,3 +247,4 @@ gcloud config unset auth/access_token_file



+
@@ -232,3 +232,4 @@ As defined by terraform in [https://registry.terraform.io/providers/hashicorp/go



+
@@ -155,3 +155,4 @@ jobs:



+
@@ -146,3 +146,4 @@ roles/bigquery.metadataViewer



+
@@ -4,3 +4,4 @@



+
@@ -23,3 +23,4 @@ Check how to do this in:



+
@@ -23,3 +23,4 @@ If yoi could just modify the code of a running version or create a new one yo co



+
@@ -44,3 +44,4 @@ https://book.hacktricks.xyz/pentesting-web/dependency-confusion



+
@@ -23,3 +23,4 @@ Grant further access over datasets, tables, rows and columns to compromised user



+
@@ -21,3 +21,4 @@ For more info about Cloud Functions check:



+
@@ -27,3 +27,4 @@ Create a backdoored Service or Job



+
@@ -71,3 +71,4 @@ But you can find further information in [https://github.com/FrancescoDiSalesGith



+
@@ -39,3 +39,4 @@ For more information check the technique in:



+
@@ -21,3 +21,4 @@ For more informatoin about Compute and VPC (Networking) check:



+
@@ -55,3 +55,4 @@ gcloud dataflow $NAME_TEMPLATE run testing \



+
@@ -23,3 +23,4 @@ gcp-filestore-persistence.md



+
@@ -23,3 +23,4 @@ gcloud logging sinks create <sink-name> <destination> --log-filter="FILTER_CONDI



+
@@ -106,3 +106,4 @@ Some remediations for these techniques are explained in [https://www.netskope.co



+
@@ -24,3 +24,4 @@ An attacker could update the secret to:



+
@@ -40,3 +40,4 @@ Another exploit script for this method can be found [here](https://github.com/Rh



+
@@ -4,3 +4,4 @@



+
@@ -45,3 +45,4 @@ Modify source code to steal credentials if they are being sent or perform a defa



+
--- a/Show More
+++ b/Show More
				`@@ -67,3 +67,4 @@ This tool allows to perform several actions like register a machine in Azure AD`
				`@@ -51,3 +51,4 @@ Check it in the original post: [https://dirkjanm.io/obtaining-domain-admin-from-`
				`@@ -11,3 +11,4 @@ The blog post discusses a privilege escalation vulnerability in Azure AD, allowi`
				`@@ -34,3 +34,4 @@ An automatically, this user will be **synced from AzureAD to the on-prem AD user`
				`@@ -163,3 +163,4 @@ Open-AADIntOffice365Portal -ImmutableID "aodilmsic30fugCUgHxsnK==" -Issuer http:`
				`@@ -119,3 +119,4 @@ python rbdel.py -u <workgroup>\\<user> -p <pass> <ip> azureadssosvc$`
				`@@ -286,3 +286,4 @@ roadrecon auth --prt-cookie <cookie> --prt-context <context> --derives-key <deri`
				`@@ -70,3 +70,4 @@ Open-AADIntOffice365Portal -ImmutableID qIMPTm2Q3kimHgg4KQyveA== -Issuer "http:/`
				`@@ -33,3 +33,4 @@ az storage queue policy set --name <queue-name> --permissions rwd --expiry 2024-`
				`@@ -43,3 +43,4 @@ az storage blob service-properties delete-policy update \`