diff --git a/src/SUMMARY.md b/src/SUMMARY.md index 478e28676..c53000a33 100644 --- a/src/SUMMARY.md +++ b/src/SUMMARY.md @@ -292,7 +292,7 @@ - [AWS - KMS Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-kms-privesc.md) - [AWS - Lambda Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc.md) - [AWS - Lightsail Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-lightsail-privesc.md) - - [AWS - Macie Enum](pentesting-cloud/aws-security/aws-privilege-escalation/aws-macie-privesc.md) + - [AWS - Macie Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-macie-privesc.md) - [AWS - Mediapackage Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-mediapackage-privesc.md) - [AWS - MQ Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-mq-privesc.md) - [AWS - MSK Privesc](pentesting-cloud/aws-security/aws-privilege-escalation/aws-msk-privesc.md) @@ -415,7 +415,7 @@ - [Az - Azure App Services](pentesting-cloud/azure-security/az-services/az-app-services.md) - [Az - Cloud Shell](pentesting-cloud/azure-security/az-services/az-cloud-shell.md) - [Az - Container Registry](pentesting-cloud/azure-security/az-services/az-container-registry.md) - - [Az - Container Instances](pentesting-cloud/azure-security/az-services/az-container-instances.md) + - [Az - Container Instances, Apps & Jobs](pentesting-cloud/azure-security/az-services/az-container-instances-apps-jobs.md) - [Az - CosmosDB](pentesting-cloud/azure-security/az-services/az-cosmosDB.md) - [Az - Intune](pentesting-cloud/azure-security/az-services/intune.md) - [Az - File Shares](pentesting-cloud/azure-security/az-services/az-file-shares.md) @@ -470,7 +470,7 @@ - [Az - App Services Privesc](pentesting-cloud/azure-security/az-privilege-escalation/az-app-services-privesc.md) - [Az - Automation Accounts Privesc](pentesting-cloud/azure-security/az-privilege-escalation/az-automation-accounts-privesc.md) - [Az - Container Registry Privesc](pentesting-cloud/azure-security/az-privilege-escalation/az-container-registry-privesc.md) - - [Az - Container Instances Privesc](pentesting-cloud/azure-security/az-privilege-escalation/az-container-instances-privesc.md) + - [Az - Container Instances, Apps & Jobs Privesc](pentesting-cloud/azure-security/az-privilege-escalation/az-container-instances-apps-jobs-privesc.md) - [Az - CosmosDB Privesc](pentesting-cloud/azure-security/az-privilege-escalation/az-cosmosDB-privesc.md) - [Az - EntraID Privesc](pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/README.md) - [Az - Conditional Access Policies & MFA Bypass](pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/az-conditional-access-policies-mfa-bypass.md) diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-organizations-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-organizations-enum.md index 3ba162ed6..bfce009ec 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-organizations-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-organizations-enum.md @@ -40,6 +40,6 @@ aws iam get-account-summary ``` ## Marejeo -- https://aws.amazon.com/organizations/ +- [https://aws.amazon.com/organizations/](https://aws.amazon.com/organizations/) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/aws-security/aws-services/aws-sqs-and-sns-enum.md b/src/pentesting-cloud/aws-security/aws-services/aws-sqs-and-sns-enum.md index 842bf8b72..c5eb4e3b6 100644 --- a/src/pentesting-cloud/aws-security/aws-services/aws-sqs-and-sns-enum.md +++ b/src/pentesting-cloud/aws-security/aws-services/aws-sqs-and-sns-enum.md @@ -4,7 +4,7 @@ ## SQS -Amazon Simple Queue Service (SQS) inawasilishwa kama **huduma ya ujumbe ya kuwasilisha inayosimamiwa kikamilifu**. Kazi yake kuu ni kusaidia katika kupanua na kutenganisha microservices, mifumo iliyosambazwa, na programu zisizo na seva. Huduma hii imeundwa kuondoa hitaji la kusimamia na kufanya kazi na middleware inayolenga ujumbe, ambayo mara nyingi inaweza kuwa ngumu na kutumia rasilimali nyingi. Kuondolewa kwa ugumu huu kunawawezesha waendelezaji kuelekeza juhudi zao kwenye vipengele vya ubunifu na tofauti vya kazi zao. +Amazon Simple Queue Service (SQS) inawasilishwa kama **huduma ya usimamizi wa ujumbe iliyo kamili**. Kazi yake kuu ni kusaidia katika kupanua na kutenganisha microservices, mifumo iliyosambazwa, na programu zisizo na seva. Huduma hii imeundwa kuondoa hitaji la kusimamia na kufanya kazi na middleware inayolenga ujumbe, ambayo mara nyingi inaweza kuwa ngumu na inahitaji rasilimali nyingi. Kuondolewa kwa ugumu huu kunawawezesha waendelezaji kuelekeza juhudi zao kwenye vipengele vya ubunifu na tofauti zaidi vya kazi zao. ### Enumeration ```bash @@ -18,7 +18,7 @@ aws sqs receive-message --queue-url aws sqs send-message --queue-url --message-body ``` > [!CAUTION] -> Pia, hata kama `--queue-url` ina eneo hakikisha unataja eneo sahihi katika **`--region`** au utapata kosa linaloonekana kama linaonyesha kwamba huna ufikiaji lakini tatizo ni eneo. +> Pia, hata kama `--queue-url` ina eneo, hakikisha unataja eneo sahihi katika **`--region`** au utapata kosa ambalo linaonekana kuashiria kwamba huna uf access lakini tatizo ni eneo. #### Unauthenticated Access @@ -46,6 +46,6 @@ aws sqs send-message --queue-url --message-body ## References -- https://docs.aws.amazon.com/cdk/api/v2/python/aws\_cdk.aws\_sqs/README.html +- [https://docs.aws.amazon.com/cdk/api/v2/python/aws\_cdk.aws\_sqs/README.html](https://docs.aws.amazon.com/cdk/api/v2/python/aws\_cdk.aws\_sqs/README.html) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/azure-security/az-persistence/az-queue-persistance.md b/src/pentesting-cloud/azure-security/az-persistence/az-queue-persistance.md index 8193c7d8e..296776026 100644 --- a/src/pentesting-cloud/azure-security/az-persistence/az-queue-persistance.md +++ b/src/pentesting-cloud/azure-security/az-persistence/az-queue-persistance.md @@ -1,4 +1,4 @@ -# Az - Hifadhi ya Queue Uendelevu +# Az - Queue Storage Persistence {{#include ../../../banners/hacktricks-training.md}} @@ -10,9 +10,9 @@ Kwa maelezo zaidi angalia: ../az-services/az-queue-enum.md {{#endref}} -### Vitendo: `Microsoft.Storage/storageAccounts/queueServices/queues/write` +### Actions: `Microsoft.Storage/storageAccounts/queueServices/queues/write` -Ruhusa hii inaruhusu mshambuliaji kuunda au kubadilisha queues na mali zao ndani ya akaunti ya hifadhi. Inaweza kutumika kuunda queues zisizoidhinishwa, kubadilisha metadata, au kubadilisha orodha za udhibiti wa ufikiaji (ACLs) ili kutoa au kupunguza ufikiaji. Uwezo huu unaweza kuharibu michakato, kuingiza data mbaya, kuhamasisha taarifa nyeti, au kubadilisha mipangilio ya queue ili kuwezesha mashambulizi zaidi. +Ruhusa hii inamruhusu mshambuliaji kuunda au kubadilisha foleni na mali zao ndani ya akaunti ya hifadhi. Inaweza kutumika kuunda foleni zisizoidhinishwa, kubadilisha metadata, au kubadilisha orodha za udhibiti wa ufikiaji (ACLs) ili kutoa au kupunguza ufikiaji. Uwezo huu unaweza kuharibu michakato, kuingiza data mbaya, kuhamasisha taarifa nyeti, au kubadilisha mipangilio ya foleni ili kuwezesha mashambulizi zaidi. ```bash az storage queue create --name --account-name @@ -22,8 +22,8 @@ az storage queue policy set --name --permissions rwd --expiry 2024- ``` ## Marejeo -- https://learn.microsoft.com/en-us/azure/storage/queues/storage-powershell-how-to-use-queues -- https://learn.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api -- https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-attributes +- [https://learn.microsoft.com/en-us/azure/storage/queues/storage-powershell-how-to-use-queues](https://learn.microsoft.com/en-us/azure/storage/queues/storage-powershell-how-to-use-queues) +- [https://learn.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api](https://learn.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api) +- [https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-attributes](https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-attributes) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-queue-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-queue-post-exploitation.md index dc58f4bb0..89379e1c6 100644 --- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-queue-post-exploitation.md +++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-queue-post-exploitation.md @@ -20,19 +20,19 @@ az storage message peek --queue-name --account-name --account-name ``` ### DataActions: `Microsoft.Storage/storageAccounts/queueServices/queues/messages/add/action` -Kwa ruhusa hii, mshambuliaji anaweza kuongeza ujumbe mpya kwenye Azure Storage Queue. Hii inawaruhusu kuingiza data mbaya au isiyoidhinishwa kwenye foleni, ambayo inaweza kusababisha kuchochea vitendo visivyokusudiwa au kuharibu huduma zinazoshughulikia ujumbe. +Kwa ruhusa hii, mshambuliaji anaweza kuongeza ujumbe mpya kwenye Azure Storage Queue. Hii inawaruhusu kuingiza data mbaya au isiyoidhinishwa kwenye foleni, ambayo inaweza kusababisha kuchochea vitendo visivyokusudiwa au kuharibu huduma za chini zinazoshughulikia ujumbe. ```bash az storage message put --queue-name --content "Injected malicious message" --account-name ``` ### DataActions: `Microsoft.Storage/storageAccounts/queueServices/queues/messages/write` -Ruhusa hii inamruhusu mshambuliaji kuongeza ujumbe mpya au kuboresha wale waliopo katika Azure Storage Queue. Kwa kutumia hii, wanaweza kuingiza maudhui mabaya au kubadilisha ujumbe waliopo, ambayo yanaweza kupelekea upotoshaji wa programu au kusababisha tabia zisizohitajika katika mifumo inayotegemea foleni. +Ruhusa hii inaruhusu mshambuliaji kuongeza ujumbe mpya au kuboresha wale waliopo katika Azure Storage Queue. Kwa kutumia hii, wanaweza kuingiza maudhui mabaya au kubadilisha ujumbe waliopo, ambayo yanaweza kupelekea upotoshaji wa programu au kusababisha tabia zisizohitajika katika mifumo inayotegemea foleni. ```bash az storage message put --queue-name --content "Injected malicious message" --account-name @@ -46,7 +46,7 @@ az storage message update --queue-name \ ``` ### Actions: `Microsoft.Storage/storageAccounts/queueServices/queues/delete` -Ruhusa hii inamruhusu mshambuliaji kufuta foleni ndani ya akaunti ya hifadhi. Kwa kutumia uwezo huu, mshambuliaji anaweza kuondoa kwa kudumu foleni na ujumbe wao wote waliounganishwa, na kusababisha usumbufu mkubwa katika michakato na kusababisha kupoteza kwa data muhimu kwa programu zinazotegemea foleni zilizoathirika. Kitendo hiki kinaweza pia kutumika kuharibu huduma kwa kuondoa vipengele muhimu vya mfumo. +Ruhusa hii inamruhusu mshambuliaji kufuta foleni ndani ya akaunti ya hifadhi. Kwa kutumia uwezo huu, mshambuliaji anaweza kuondoa kwa kudumu foleni na ujumbe wao wote waliounganishwa, na kusababisha usumbufu mkubwa katika michakato na kusababisha kupoteza data muhimu kwa programu zinazotegemea foleni zilizoathiriwa. Kitendo hiki kinaweza pia kutumika kuharibu huduma kwa kuondoa vipengele muhimu vya mfumo. ```bash az storage queue delete --name --account-name ``` @@ -68,8 +68,8 @@ az storage queue policy set --name --permissions rwd --expiry 2024- ``` ## Marejeo -- https://learn.microsoft.com/en-us/azure/storage/queues/storage-powershell-how-to-use-queues -- https://learn.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api -- https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-attributes +- [https://learn.microsoft.com/en-us/azure/storage/queues/storage-powershell-how-to-use-queues](https://learn.microsoft.com/en-us/azure/storage/queues/storage-powershell-how-to-use-queues) +- [https://learn.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api](https://learn.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api) +- [https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-attributes](https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-attributes) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-servicebus-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-servicebus-post-exploitation.md index 149643f91..7cc7adf80 100644 --- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-servicebus-post-exploitation.md +++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-servicebus-post-exploitation.md @@ -18,7 +18,7 @@ az servicebus namespace delete --resource-group --name --namespace-name --name ``` @@ -34,23 +34,16 @@ Mshambuliaji mwenye ruhusa hii anaweza kufuta usajili wa Azure Service Bus. Kite ```bash az servicebus topic subscription delete --resource-group --namespace-name --topic-name --name ``` -### Actions: `Microsoft.ServiceBus/namespaces/write` & `Microsoft.ServiceBus/namespaces/read` - -Mshambuliaji mwenye ruhusa za kuunda au kubadilisha Azure Service Bus namespaces anaweza kutumia hii kuharibu shughuli, kupeleka rasilimali zisizoidhinishwa, au kufichua data nyeti. Wanaweza kubadilisha mipangilio muhimu kama vile kuwezesha ufikiaji wa mtandao wa umma, kupunguza mipangilio ya usimbuaji, au kubadilisha SKUs ili kudhoofisha utendaji au kuongeza gharama. Zaidi ya hayo, wanaweza kuzima uthibitishaji wa ndani, kubadilisha maeneo ya nakala, au kurekebisha toleo la TLS ili kudhoofisha udhibiti wa usalama, na kufanya makosa ya usanidi wa namespace kuwa hatari kubwa baada ya kutekeleza. -```bash -az servicebus namespace create --resource-group --name --location -az servicebus namespace update --resource-group --name --tags -``` ### Actions: `Microsoft.ServiceBus/namespaces/queues/write` (`Microsoft.ServiceBus/namespaces/queues/read`) -Mshambuliaji mwenye ruhusa za kuunda au kubadilisha Azure Service Bus queues (ili kubadilisha queue unahitaji pia Action:`Microsoft.ServiceBus/namespaces/queues/read`) anaweza kutumia hii kukamata data, kuharibu workflows, au kuwezesha ufikiaji usioidhinishwa. Wanaweza kubadilisha mipangilio muhimu kama vile kupeleka ujumbe kwa maeneo mabaya, kubadilisha TTL ya ujumbe ili kuhifadhi au kufuta data vibaya, au kuwezesha dead-lettering kuingilia kati usimamizi wa makosa. Zaidi ya hayo, wanaweza kubadilisha saizi za queue, muda wa kufunga, au hali ili kuharibu utendaji wa huduma au kuepuka kugunduliwa, na kufanya hii kuwa hatari kubwa baada ya kutekeleza. +Mshambuliaji mwenye ruhusa za kuunda au kubadilisha Azure Service Bus queues (ili kubadilisha queue unahitaji pia Action:`Microsoft.ServiceBus/namespaces/queues/read`) anaweza kutumia hii kukamata data, kuharibu workflows, au kuwezesha ufikiaji usioidhinishwa. Wanaweza kubadilisha mipangilio muhimu kama vile kupeleka ujumbe kwa maeneo mabaya, kubadilisha TTL ya ujumbe ili kuhifadhi au kufuta data vibaya, au kuwezesha dead-lettering kuingilia kati usimamizi wa makosa. Zaidi ya hayo, wanaweza kubadilisha saizi za queue, muda wa kufunga, au hali ili kuharibu utendaji wa huduma au kuepuka kugunduliwa, na kufanya hii kuwa hatari kubwa baada ya unyakuzi. ```bash az servicebus queue create --resource-group --namespace-name --name az servicebus queue update --resource-group --namespace-name --name ``` ### Actions: `Microsoft.ServiceBus/namespaces/topics/write` (`Microsoft.ServiceBus/namespaces/topics/read`) -Mshambuliaji mwenye ruhusa za kuunda au kubadilisha mada (ili kubadilisha mada unahitaji pia Action: `Microsoft.ServiceBus/namespaces/topics/read`) ndani ya eneo la Azure Service Bus anaweza kutumia hii kuharibu mchakato wa ujumbe, kufichua data nyeti, au kuwezesha vitendo visivyoidhinishwa. Kwa kutumia amri kama az servicebus topic update, wanaweza kubadilisha mipangilio kama vile kuwezesha ugawaji kwa matumizi mabaya ya upanuzi, kubadilisha mipangilio ya TTL ili kuhifadhi au kutupa ujumbe vibaya, au kuzima ugunduzi wa nakala ili kupita udhibiti. Zaidi ya hayo, wanaweza kurekebisha mipaka ya ukubwa wa mada, kubadilisha hali ili kuharibu upatikanaji, au kuunda mada za haraka kuhifadhi ujumbe waliokamatwa kwa muda, na kufanya usimamizi wa mada kuwa kipaumbele muhimu kwa kupunguza madhara baada ya kutekeleza. +Mshambuliaji mwenye ruhusa za kuunda au kubadilisha mada (ili kubadilisha mada unahitaji pia Action:`Microsoft.ServiceBus/namespaces/topics/read`) ndani ya eneo la Azure Service Bus anaweza kutumia hii kuharibu mchakato wa ujumbe, kufichua data nyeti, au kuwezesha vitendo visivyoidhinishwa. Kwa kutumia amri kama az servicebus topic update, wanaweza kubadilisha mipangilio kama vile kuwezesha ugawaji kwa matumizi mabaya ya upanuzi, kubadilisha mipangilio ya TTL ili kuhifadhi au kutupa ujumbe vibaya, au kuzima ugunduzi wa nakala ili kupita udhibiti. Zaidi ya hayo, wanaweza kurekebisha mipaka ya ukubwa wa mada, kubadilisha hali ili kuharibu upatikanaji, au kuunda mada za haraka kuhifadhi ujumbe waliokamatwa kwa muda, na kufanya usimamizi wa mada kuwa kipaumbele muhimu kwa kupunguza madhara baada ya unyakuzi. ```bash az servicebus topic create --resource-group --namespace-name --name az servicebus topic update --resource-group --namespace-name --name @@ -62,22 +55,22 @@ Mshambuliaji mwenye ruhusa za kuunda au kubadilisha usajili (ili kubadilisha usa az servicebus topic subscription create --resource-group --namespace-name --topic-name --name az servicebus topic subscription update --resource-group --namespace-name --topic-name --name ``` -### Actions: `AuthorizationRules` Tuma & Pokea Ujumbe +### Actions: `AuthorizationRules` Send & Recive Messages -Angalia hapa: +Tazama hapa: {{#ref}} ../az-privilege-escalation/az-queue-privesc.md {{#endref}} -## Marejeo +## References -- https://learn.microsoft.com/en-us/azure/storage/queues/storage-powershell-how-to-use-queues -- https://learn.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api -- https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-attributes -- https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-python-how-to-use-topics-subscriptions?tabs=passwordless -- https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/integration#microsoftservicebus -- https://learn.microsoft.com/en-us/cli/azure/servicebus/namespace?view=azure-cli-latest -- https://learn.microsoft.com/en-us/cli/azure/servicebus/queue?view=azure-cli-latest +- [https://learn.microsoft.com/en-us/azure/storage/queues/storage-powershell-how-to-use-queues](https://learn.microsoft.com/en-us/azure/storage/queues/storage-powershell-how-to-use-queues) +- [https://learn.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api](https://learn.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api) +- [https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-attributes](https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-attributes) +- [https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-python-how-to-use-topics-subscriptions?tabs=passwordless](https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-python-how-to-use-topics-subscriptions?tabs=passwordless) +- [https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/integration#microsoftservicebus](https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/integration#microsoftservicebus) +- [https://learn.microsoft.com/en-us/cli/azure/servicebus/namespace?view=azure-cli-latest](https://learn.microsoft.com/en-us/cli/azure/servicebus/namespace?view=azure-cli-latest) +- [https://learn.microsoft.com/en-us/cli/azure/servicebus/queue?view=azure-cli-latest](https://learn.microsoft.com/en-us/cli/azure/servicebus/queue?view=azure-cli-latest) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-sql-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-sql-post-exploitation.md index 0bb9dd39b..378416431 100644 --- a/src/pentesting-cloud/azure-security/az-post-exploitation/az-sql-post-exploitation.md +++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-sql-post-exploitation.md @@ -19,6 +19,16 @@ az sql db create --resource-group --server --name # Update Database az sql db update --resource-group --server --name --max-size +``` +Kwa ruhusa hizi (`Microsoft.Sql/servers/read` && `Microsoft.Sql/servers/databases/write`) unaweza kurejesha database iliyofutwa: +```bash +az sql db restore \ +--dest-name \ +--name \ +--resource-group \ +--server \ +--deleted-time "" + ``` ### `Microsoft.Sql/servers/elasticPools/write` && `Microsoft.Sql/servers/elasticPools/read` @@ -42,7 +52,7 @@ az sql elastic-pool update \ ``` ### `Microsoft.Sql/servers/auditingSettings/read` && `Microsoft.Sql/servers/auditingSettings/write` -Kwa ruhusa hii, unaweza kubadilisha au kuwezesha mipangilio ya ukaguzi kwenye Azure SQL Server. Hii inaweza kumruhusu mshambuliaji au mtumiaji aliyeidhinishwa kubadilisha usanidi wa ukaguzi, ambayo inaweza kufunika nyayo au kuelekeza kumbukumbu za ukaguzi kwenye eneo chini ya udhibiti wao. Hii inaweza kuzuia ufuatiliaji wa usalama au kuwezesha kuendelea kufuatilia vitendo. KUMBUKA: Ili kuwezesha ukaguzi kwa Azure SQL Server ukitumia Blob Storage, lazima uunganishe akaunti ya hifadhi ambapo kumbukumbu za ukaguzi zinaweza kuhifadhiwa. +Kwa ruhusa hii, unaweza kubadilisha au kuwezesha mipangilio ya ukaguzi kwenye Azure SQL Server. Hii inaweza kumruhusu mshambuliaji au mtumiaji aliyeidhinishwa kubadilisha usanidi wa ukaguzi, ambayo inaweza kuficha alama au kuelekeza kumbukumbu za ukaguzi kwenye eneo chini ya udhibiti wao. Hii inaweza kuzuia ufuatiliaji wa usalama au kuwezesha kuendelea kufuatilia vitendo. KUMBUKA: Ili kuwezesha ukaguzi kwa Azure SQL Server ukitumia Blob Storage, lazima uunganishe akaunti ya hifadhi ambapo kumbukumbu za ukaguzi zinaweza kuhifadhiwa. ```bash az sql server audit-policy update \ --server \ @@ -62,7 +72,7 @@ az sql server connection-policy update \ ``` ### `Microsoft.Sql/servers/databases/export/action` -Kwa ruhusa hii, unaweza kusafirisha database kutoka kwa Azure SQL Server hadi akaunti ya hifadhi. Mshambuliaji au mtumiaji aliyeidhinishwa mwenye ruhusa hii anaweza kuhamasisha data nyeti kutoka kwenye database kwa kuisafirisha hadi mahali wanapodhibiti, na kuleta hatari kubwa ya uvujaji wa data. Ni muhimu kujua funguo za hifadhi ili uweze kufanya hivi. +Kwa ruhusa hii, unaweza kusafirisha database kutoka kwa Azure SQL Server hadi akaunti ya hifadhi. Mshambuliaji au mtumiaji aliyeidhinishwa mwenye ruhusa hii anaweza kuhamasisha data nyeti kutoka kwa database kwa kuisafirisha hadi mahali wanapodhibiti, na kuleta hatari kubwa ya uvunjaji wa data. Ni muhimu kujua funguo za hifadhi ili uweze kufanya hivi. ```bash az sql db export \ --server \ @@ -87,4 +97,41 @@ az sql db import --admin-user \ --storage-key \ --storage-uri `https://.blob.core.windows.net/bacpac-container/MyDatabase.bacpac` ``` +### `Microsoft.Sql/servers/connectionPolicies/write` && `Microsoft.Sql/servers/connectionPolicies/read` + +Kwa ruhusa hizi, mtumiaji anaweza kubadilisha na kupata sera za muunganisho za seva ya Azure SQL. Ruhusa hizi zinamruhusu mtu kubadilisha jinsi wateja wanavyoungana na seva—kuchagua kati ya mbinu kama vile kuhamasisha au wakala—ambayo inaweza kutumika kudhoofisha usalama, kuhamasisha trafiki, au kukamata data nyeti ikiwa imewekwa vibaya. +```bash +az sql server conn-policy update \ +--resource-group \ +--server \ +--connection-policy +``` +### `Microsoft.Sql/servers/keys/write` && `Microsoft.Sql/servers/keys/read` + +Kwa ruhusa hizi, mtumiaji anaweza kuboresha na kupata funguo za usimbuaji zinazohusiana na Azure SQL Server. Funguo hizi mara nyingi hutumiwa kulinda data nyeti kupitia usimbuaji, hivyo kuziendesha kunaweza kuhatarisha usalama wa data kwa kuruhusu usimbuaji usioidhinishwa au mabadiliko ya kuzungusha funguo. +```bash +az sql server key create \ +--resource-group MyResourceGroup \ +--server MyServer \ +--kid "https://mykeyvault.vault.azure.net/keys/mykey/1234567890abcdef +``` +### `Microsoft.Sql/servers/databases/ledgerDigestUploads/disable/action`, `Microsoft.Sql/locations/ledgerDigestUploadsAzureAsyncOperation/read`, `Microsoft.Sql/locations/ledgerDigestUploadsOperationResults/read` + +Hii ruhusa inaruhusu kuzima Ledger Digest kwa Azure SQL Database, ambayo inasimamisha upakiaji wa mara kwa mara wa rekodi za cryptographic digest kwenye Azure Blob Storage ambazo zinathibitisha uadilifu wa data. +```bash +az sql db ledger-digest-uploads disable \ +--name ledgerDB \ +--resource-group myResourceGroup \ +--server my-sql-server +``` +### `Microsoft.Sql/servers/databases/transparentDataEncryption/write`, `Microsoft.Sql/locations/transparentDataEncryptionAzureAsyncOperation/read`, `Microsoft.Sql/servers/databases/transparentDataEncryption/read` + +Ruhusa hii inaruhusu mtumiaji aliyeidhinishwa au mshambuliaji kuwezesha, kuzima, au kubadilisha mipangilio ya Transparent Data Encryption (TDE) kwenye hifadhidata ya Azure SQL, ambayo inaweza kuathiri usalama wa data kwa kubadilisha mipangilio ya usimbaji. +```bash +az sql db tde set \ +--database \ +--resource-group \ +--server \ +--status +``` {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-container-instances-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-container-instances-privesc.md deleted file mode 100644 index 14c2160b2..000000000 --- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-container-instances-privesc.md +++ /dev/null @@ -1,64 +0,0 @@ -# Az - Azure Container Instances Privesc - -{{#include ../../../banners/hacktricks-training.md}} - -## Azure Container Instances - -Kwa maelezo zaidi angalia: - -{{#ref}} -../az-services/az-container-instances.md -{{#endref}} - -### `Microsoft.ContainerInstance/containerGroups/read`, `Microsoft.ContainerInstance/containerGroups/containers/exec/action` - -Hizi ruhusa zinamruhusu mtumiaji **kutekeleza amri** katika kontena linalofanya kazi. Hii inaweza kutumika **kuinua mamlaka** katika kontena ikiwa ina kitambulisho chochote kinachosimamiwa kilichounganishwa. Bila shaka, pia inawezekana kufikia msimbo wa chanzo na taarifa nyingine yoyote nyeti iliyohifadhiwa ndani ya kontena. - -Ili kutekeleza `ls` na kupata matokeo ni rahisi kama: -```bash -az container exec --name --resource-group --exec-command 'ls' -``` -Ni pia inawezekana **kusoma matokeo** ya kontena kwa: -```bash -az container attach --name --resource-group -``` -Au pata rekodi za: -```bash -az container logs --name --resource-group -``` -### `Microsoft.ContainerInstance/containerGroups/write`, `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` - -Hizi ruhusa zinaruhusu **kuunganisha utambulisho wa mtumiaji ulioendeshwa** kwa kundi la kontena. Hii ni muhimu sana kuongeza mamlaka katika kontena. - -Ili kuunganisha utambulisho wa mtumiaji ulioendeshwa kwa kundi la kontena: -```bash -az rest \ ---method PATCH \ ---url "/subscriptions//resourceGroups//providers/Microsoft.ContainerInstance/containerGroups/?api-version=2021-09-01" \ ---body '{ -"identity": { -"type": "UserAssigned", -"userAssignedIdentities": { -"/subscriptions//resourceGroups//providers/Microsoft.ManagedIdentity/userAssignedIdentities/": {} -} -} -}' \ ---headers "Content-Type=application/json" -``` -### `Microsoft.Resources/subscriptions/resourcegroups/read`, `Microsoft.ContainerInstance/containerGroups/write`, `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` - -Hizi ruhusa zinaruhusu **kuunda au kusasisha kundi la kontena** lenye **utambulisho wa mtumiaji uliopewa usimamizi** ulioambatanishwa nalo. Hii ni muhimu sana katika kupandisha mamlaka ndani ya kontena. -```bash -az container create \ ---resource-group > \ ---name nginx2 \ ---image mcr.microsoft.com/oss/nginx/nginx:1.9.15-alpine \ ---assign-identity "/subscriptions//resourceGroups//providers/Microsoft.ManagedIdentity/userAssignedIdentities/" \ ---restart-policy OnFailure \ ---os-type Linux \ ---cpu 1 \ ---memory 1.0 -``` -Zaidi ya hayo, inawezekana pia kuboresha kundi la kontena lililopo kwa kuongeza kwa mfano **`--command-line` argument** yenye shell ya kurudi. - -{{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-queue-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-queue-privesc.md index b28c9cda6..501977841 100644 --- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-queue-privesc.md +++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-queue-privesc.md @@ -12,7 +12,7 @@ Kwa maelezo zaidi angalia: ### DataActions: `Microsoft.Storage/storageAccounts/queueServices/queues/messages/read` -Mshambuliaji mwenye ruhusa hii anaweza kuangalia ujumbe kutoka kwa Azure Storage Queue. Hii inamruhusu mshambuliaji kuona maudhui ya ujumbe bila kuashiria kuwa yamechakatwa au kubadilisha hali yao. Hii inaweza kusababisha ufikiaji usioidhinishwa wa taarifa nyeti, ikiruhusu uhamasishaji wa data au kukusanya taarifa kwa mashambulizi zaidi. +Mshambuliaji mwenye ruhusa hii anaweza kuangalia ujumbe kutoka kwa Azure Storage Queue. Hii inamruhusu mshambuliaji kuona maudhui ya ujumbe bila kuashiria kuwa umeshughulikiwa au kubadilisha hali yao. Hii inaweza kusababisha ufikiaji usioidhinishwa wa taarifa nyeti, ikiruhusu uhamasishaji wa data au kukusanya taarifa kwa mashambulizi zaidi. ```bash az storage message peek --queue-name --account-name ``` @@ -32,7 +32,7 @@ az storage message put --queue-name --content "Injected malicious m ``` ### DataActions: `Microsoft.Storage/storageAccounts/queueServices/queues/messages/write` -Ruhusa hii inamruhusu mshambuliaji kuongeza ujumbe mpya au kuboresha wale waliopo katika Azure Storage Queue. Kwa kutumia hii, wanaweza kuingiza maudhui mabaya au kubadilisha ujumbe waliopo, ambayo yanaweza kupelekea upotoshaji wa programu au kusababisha tabia zisizohitajika katika mifumo inayotegemea foleni. +Ruhusa hii inaruhusu mshambuliaji kuongeza ujumbe mpya au kuboresha wale waliopo katika Azure Storage Queue. Kwa kutumia hii, wanaweza kuingiza maudhui mabaya au kubadilisha ujumbe waliopo, ambayo yanaweza kupelekea upotoshaji wa programu au kusababisha tabia zisizohitajika katika mifumo inayotegemea foleni. ```bash az storage message put --queue-name --content "Injected malicious message" --account-name @@ -46,7 +46,7 @@ az storage message update --queue-name \ ``` ### Action: `Microsoft.Storage/storageAccounts/queueServices/queues/write` -Ruhusa hii inaruhusu mshambuliaji kuunda au kubadilisha foleni na mali zao ndani ya akaunti ya hifadhi. Inaweza kutumika kuunda foleni zisizoidhinishwa, kubadilisha metadata, au kubadilisha orodha za udhibiti wa ufikiaji (ACLs) ili kutoa au kupunguza ufikiaji. Uwezo huu unaweza kuharibu mchakato wa kazi, kuingiza data mbaya, kuhamasisha taarifa nyeti, au kubadilisha mipangilio ya foleni ili kuwezesha mashambulizi zaidi. +Ruhusa hii inaruhusu mshambuliaji kuunda au kubadilisha foleni na mali zao ndani ya akaunti ya hifadhi. Inaweza kutumika kuunda foleni zisizoidhinishwa, kubadilisha metadata, au kubadilisha orodha za udhibiti wa ufikiaji (ACLs) ili kutoa au kupunguza ufikiaji. Uwezo huu unaweza kuharibu michakato ya kazi, kuingiza data mbaya, kuhamasisha taarifa nyeti, au kubadilisha mipangilio ya foleni ili kuwezesha mashambulizi zaidi. ```bash az storage queue create --name --account-name @@ -54,10 +54,10 @@ az storage queue metadata update --name --metadata key1=value1 key2 az storage queue policy set --name --permissions rwd --expiry 2024-12-31T23:59:59Z --account-name ``` -## Marejeleo +## Marejeo -- https://learn.microsoft.com/en-us/azure/storage/queues/storage-powershell-how-to-use-queues -- https://learn.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api -- https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-attributes +- [https://learn.microsoft.com/en-us/azure/storage/queues/storage-powershell-how-to-use-queues](https://learn.microsoft.com/en-us/azure/storage/queues/storage-powershell-how-to-use-queues) +- [https://learn.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api](https://learn.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api) +- [https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-attributes](https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-attributes) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-servicebus-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-servicebus-privesc.md index 48d82765d..e045ae334 100644 --- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-servicebus-privesc.md +++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-servicebus-privesc.md @@ -12,9 +12,9 @@ Kwa maelezo zaidi angalia: ### Microsoft.ServiceBus/namespaces/authorizationrules/listKeys/action AU Microsoft.ServiceBus/namespaces/authorizationrules/regenerateKeys/action -Ruhusa hizi zinakuwezesha kupata au kuunda upya funguo za sheria za mamlaka za ndani ndani ya nafasi ya Service Bus. Kutumia funguo hizi inawezekana kuthibitisha kama nafasi ya Service Bus, ikikuruhusu kutuma ujumbe kwenye foleni au mada yoyote, kupokea ujumbe kutoka kwenye foleni au usajili wowote, au kwa uwezekano kuingiliana na mfumo kwa njia ambazo zinaweza kuharibu shughuli, kujifanya kuwa watumiaji halali, au kuingiza data mbaya katika mchakato wa ujumbe. +Ruhusa hizi zinakuwezesha kupata au kuunda upya funguo za sheria za mamlaka za ndani ndani ya nafasi ya Service Bus. Kutumia funguo hizi inawezekana kuthibitisha kama nafasi ya Service Bus, ikikuwezesha kutuma ujumbe kwa foleni au mada yoyote, kupokea ujumbe kutoka kwa foleni au usajili wowote, au kwa uwezekano kuingiliana na mfumo kwa njia ambazo zinaweza kuharibu shughuli, kujifanya kuwa watumiaji halali, au kuingiza data mbaya katika mchakato wa ujumbe. -Kumbuka kwamba kwa kawaida **`RootManageSharedAccessKey` sheria ina udhibiti kamili** juu ya nafasi ya Service Bus na inatumika na `az` cli, hata hivyo, sheria nyingine zenye thamani nyingine za funguo zinaweza kuwepo. +Kumbuka kwamba kwa default **`RootManageSharedAccessKey` sheria ina udhibiti kamili** juu ya nafasi ya Service Bus na inatumika na `az` cli, hata hivyo, sheria nyingine zenye thamani nyingine za funguo zinaweza kuwepo. ```bash # List keys az servicebus namespace authorization-rule keys list --resource-group --namespace-name --authorization-rule-name RootManageSharedAccessKey [--authorization-rule-name RootManageSharedAccessKey] @@ -41,7 +41,7 @@ az servicebus namespace authorization-rule update \ ``` ### Microsoft.ServiceBus/namespaces/[queues|topics]/authorizationRules/ListKeys/action AU Microsoft.ServiceBus/namespaces/[queues|topics]/authorizationRules/regenerateKeys/action -Mada maalum na foleni ndani ya jina la nafasi ya Service Bus zinaweza kuwa na sheria zao zaidhini, ambazo zinaweza kutumika kudhibiti ufikiaji wa chombo hicho. Kwa kuwa na ruhusa hizi, unaweza **kupata au kuunda upya funguo za sheria hizi zaidhini za ndani**, na kukuwezesha kuthibitisha kama chombo hicho na kwa uwezekano kutuma au kupokea ujumbe, kusimamia usajili, au kuingiliana na mfumo kwa njia ambazo zinaweza kuharibu shughuli, kuiga watumiaji halali, au kuingiza data mbaya katika mchakato wa ujumbe. +Mada maalum na foleni ndani ya jina la nafasi ya Service Bus zinaweza kuwa na sheria zao zaidhini, ambazo zinaweza kutumika kudhibiti ufikiaji wa chombo hicho. Kwa kuwa na ruhusa hizi, unaweza **kupata au kuunda upya funguo za sheria hizi zaidhini za ndani**, na hivyo kukuwezesha kuthibitisha kama chombo hicho na kwa uwezekano kutuma au kupokea ujumbe, kusimamia usajili, au kuingiliana na mfumo kwa njia ambazo zinaweza kuharibu shughuli, kuiga watumiaji halali, au kuingiza data mbaya katika mchakato wa ujumbe. ```bash # List keys (topics) az servicebus topic authorization-rule keys list --resource-group --namespace-name --topic-name --name @@ -57,7 +57,7 @@ az servicebus queue authorization-rule keys renew --key [PrimaryKey|SecondaryKey ``` ### Microsoft.ServiceBus/namespaces/[queues|topics]/authorizationRules/write -Kwa ruhusa hii inawezekana **kuunda sheria mpya ya ruhusa** yenye ruhusa zote na funguo zake mwenyewe kwa: +Kwa ruhusa hii inawezekana **kuunda sheria mpya ya idhini** yenye ruhusa zote na funguo zake mwenyewe kwa: ```bash # In a topic az servicebus topic authorization-rule create --resource-group --namespace-name --topic-name --name --rights Manage Listen Send @@ -82,129 +82,204 @@ Kwa ruhusa hizi **mshambuliaji anaweza kurejesha "uthibitishaji wa ndani"** kwa ```bash az servicebus namespace update --disable-local-auth false -n --resource-group ``` -### Tuma Ujumbe na funguo (Microsoft.ServiceBus/namespaces/authorizationRules/listkeys/action AU Microsoft.ServiceBus/namespaces/authorizationRules/regenerateKeys/action) +### Send Messages with keys (Microsoft.ServiceBus/namespaces/authorizationRules/listkeys/action OR Microsoft.ServiceBus/namespaces/authorizationRules/regenerateKeys/action) -Unaweza kupata `PrimaryConnectionString`, ambayo inafanya kazi kama kitambulisho kwa ajili ya Service Bus namespace. Kwa kutumia uhusiano huu, unaweza kuthibitisha kikamilifu kama Service Bus namespace, na kukuwezesha kutuma ujumbe kwa foleni au mada yoyote na kwa uwezekano kuingiliana na mfumo kwa njia ambazo zinaweza kuharibu shughuli, kujifanya kuwa watumiaji halali, au kuingiza data mbaya katika mchakato wa ujumbe. +Unaweza kupata `PrimaryConnectionString`, ambayo inafanya kazi kama kitambulisho kwa ajili ya Service Bus namespace. Kwa kutumia hii connection string, unaweza kuthibitisha kikamilifu kama Service Bus namespace, na kukuwezesha kutuma ujumbe kwa foleni au mada yoyote na kwa uwezekano kuingiliana na mfumo kwa njia ambazo zinaweza kuharibu shughuli, kujifanya kuwa watumiaji halali, au kuingiza data mbaya katika mchakato wa ujumbe. Njia hii inafanya kazi ikiwa `--disable-local-auth` imewekwa kuwa false. ```python -#You need to install the following libraries -#pip install azure-servicebus -#pip install aiohttp -#pip install azure-identity - import asyncio from azure.servicebus.aio import ServiceBusClient from azure.servicebus import ServiceBusMessage -# Constants NAMESPACE_CONNECTION_STR = "" -TOPIC_NAME = "" +TOPIC_OR_QUEUE_NAME = "" -# Function to send a single message to a Service Bus topic -async def send_individual_message(publisher): -# Prepare a single message with updated content -single_message = ServiceBusMessage("Hacktricks-Training: Single Item") -# Send the message to the topic -await publisher.send_messages(single_message) -print("Sent a single message containing 'Hacktricks-Training'") +async def send_message(): +async with ServiceBusClient.from_connection_string(NAMESPACE_CONNECTION_STR) as client: +async with client.get_topic_sender(topic_name=TOPIC_OR_QUEUE_NAME) as sender: +await sender.send_messages(ServiceBusMessage("Hacktricks-Training: Single Item")) +print("Sent message") -# Function to send multiple messages to a Service Bus topic -async def send_multiple_messages(publisher): -# Generate a collection of messages with updated content -message_list = [ServiceBusMessage(f"Hacktricks-Training: Item {i+1} in list") for i in range(5)] -# Send the entire collection of messages to the topic -await publisher.send_messages(message_list) -print("Sent a list of 5 messages containing 'Hacktricks-Training'") +asyncio.run(send_message()) +``` +Zaidi ya hayo, unaweza kutuma ujumbe na az rest, katika kesi hii unahitaji kuunda token ya sas kutumia. +```python +import time, urllib.parse, hmac, hashlib, base64 -# Function to send a grouped batch of messages to a Service Bus topic -async def send_grouped_messages(publisher): -# Send a grouped batch of messages with updated content -async with publisher: -grouped_message_batch = await publisher.create_message_batch() -for i in range(10): -try: -# Append a message to the batch with updated content -grouped_message_batch.add_message(ServiceBusMessage(f"Hacktricks-Training: Item {i+1}")) -except ValueError: -# If batch reaches its size limit, handle by creating another batch -break -# Dispatch the batch of messages to the topic -await publisher.send_messages(grouped_message_batch) -print("Sent a batch of 10 messages containing 'Hacktricks-Training'") +def generate_sas_token(uri, key_name, key, expiry_in_seconds=3600): +expiry = int(time.time() + expiry_in_seconds) +string_to_sign = urllib.parse.quote_plus(uri) + "\n" + str(expiry) +signed_hmac_sha256 = hmac.new(key.encode('utf-8'), string_to_sign.encode('utf-8'), hashlib.sha256).digest() +signature = urllib.parse.quote_plus(base64.b64encode(signed_hmac_sha256)) +token = f"SharedAccessSignature sr={urllib.parse.quote_plus(uri)}&sig={signature}&se={expiry}&skn={key_name}" +return token -# Main function to execute all tasks -async def execute(): -# Instantiate the Service Bus client with the connection string -async with ServiceBusClient.from_connection_string( -conn_str=NAMESPACE_CONNECTION_STR, -logging_enable=True) as sb_client: -# Create a topic sender for dispatching messages to the topic -publisher = sb_client.get_topic_sender(topic_name=TOPIC_NAME) -async with publisher: -# Send a single message -await send_individual_message(publisher) -# Send multiple messages -await send_multiple_messages(publisher) -# Send a batch of messages -await send_grouped_messages(publisher) +# Replace these with your actual values +resource_uri = "https://.servicebus.windows.net/" +key_name = "" +primary_key = "" -# Run the asynchronous execution -asyncio.run(execute()) -print("Messages Sent") -print("----------------------------") +sas_token = generate_sas_token(resource_uri, key_name, primary_key) +print(sas_token) +``` + +```bash +az rest --method post \ +--uri "https://.servicebus.windows.net//messages" \ +--headers "Content-Type=application/atom+xml;type=entry;charset=utf-8" "Authorization=SharedAccessSignature sr=https%3A%2F%2F.servicebus.windows.net%2F&sig=&se=&skn=" \ +--body "" ``` -### Pokea na funguo (Microsoft.ServiceBus/namespaces/authorizationRules/listkeys/action AU Microsoft.ServiceBus/namespaces/authorizationRules/regenerateKeys/action) +### Receive with keys (Microsoft.ServiceBus/namespaces/authorizationRules/listkeys/action OR Microsoft.ServiceBus/namespaces/authorizationRules/regenerateKeys/action) -Unaweza kupata PrimaryConnectionString, ambayo inatumika kama kitambulisho kwa ajili ya Service Bus namespace. Kwa kutumia hii connection string, unaweza kupokea ujumbe kutoka kwa foleni au usajili wowote ndani ya namespace, ikiruhusu ufikiaji wa data ambayo inaweza kuwa nyeti au muhimu, kuwezesha uhamasishaji wa data, au kuingilia kati mchakato wa ujumbe na workflows za programu. +Unaweza kupata PrimaryConnectionString, ambayo inatumika kama akidi kwa ajili ya Service Bus namespace. Kwa kutumia hii connection string, unaweza kupokea ujumbe kutoka kwa foleni au usajili wowote ndani ya namespace, ikiruhusu ufikiaji wa data ambayo inaweza kuwa nyeti au muhimu, ikiharakisha uhamishaji wa data, au kuingilia kati mchakato wa ujumbe na workflows za programu. Njia hii inafanya kazi ikiwa `--disable-local-auth` imewekwa kuwa false. ```python -#You need to install the following libraries -#pip install azure-servicebus -#pip install aiohttp -#pip install azure-identity - import asyncio from azure.servicebus.aio import ServiceBusClient -NAMESPACE_CONNECTION_STR = "" -TOPIC_NAME = "" -SUBSCRIPTION_NAME = "" #Topic Subscription +CONN_STR = "" +QUEUE = "" -# Function to receive and process messages from a Service Bus subscription -async def receive_and_process_messages(): -# Create a Service Bus client using the connection string -async with ServiceBusClient.from_connection_string( -conn_str=NAMESPACE_CONNECTION_STR, -logging_enable=True) as servicebus_client: +# For topics/subscriptions, you would use: +# TOPIC = "" +# SUBSCRIPTION = "" -# Get the Subscription Receiver object for the specified topic and subscription -receiver = servicebus_client.get_subscription_receiver( -topic_name=TOPIC_NAME, -subscription_name=SUBSCRIPTION_NAME, -max_wait_time=5 -) - -async with receiver: -# Receive messages with a defined maximum wait time and count -received_msgs = await receiver.receive_messages( -max_wait_time=5, -max_message_count=20 -) -for msg in received_msgs: -print("Received: " + str(msg)) -# Complete the message to remove it from the subscription +async def receive(): +async with ServiceBusClient.from_connection_string(CONN_STR) as client: +# For a queue receiver: +async with client.get_queue_receiver(queue_name=QUEUE, max_wait_time=5) as receiver: +msgs = await receiver.receive_messages(max_wait_time=5, max_message_count=20) +for msg in msgs: +print("Received:", msg) await receiver.complete_message(msg) -# Run the asynchronous message processing function -asyncio.run(receive_and_process_messages()) -print("Message Receiving Completed") -print("----------------------------") +# For a topic/subscription receiver (commented out): +# async with client.get_subscription_receiver(topic_name=TOPIC, subscription_name=SUBSCRIPTION, max_wait_time=5) as receiver: +# msgs = await receiver.receive_messages(max_wait_time=5, max_message_count=20) +# for msg in msgs: +# print("Received:", msg) +# await receiver.complete_message(msg) + +asyncio.run(receive()) +print("Done receiving messages") +``` +Zaidi ya hayo, unaweza kutuma ujumbe kwa kutumia az rest, katika kesi hii unahitaji kuunda token ya sas ili kuitumia. +```python +import time, urllib.parse, hmac, hashlib, base64 + +def generate_sas_token(uri, key_name, key, expiry_in_seconds=3600): +expiry = int(time.time() + expiry_in_seconds) +string_to_sign = urllib.parse.quote_plus(uri) + "\n" + str(expiry) +signature = urllib.parse.quote_plus(base64.b64encode( +hmac.new(key.encode('utf-8'), string_to_sign.encode('utf-8'), hashlib.sha256).digest() +)) +token = f"SharedAccessSignature sr={urllib.parse.quote_plus(uri)}&sig={signature}&se={expiry}&skn={key_name}" +return token + +# Example usage: +resource_uri = "https://.servicebus.windows.net/queue" # For queue +# resource_uri = "https://.servicebus.windows.net//subscriptions/" # For topic subscription +sas_token = generate_sas_token(resource_uri, "", "") +print(sas_token) + +``` +Kwa foleni unaweza kupata au kuangalia ujumbe (kupata ujumbe kutafuta kuondoa, wakati kuangalia hakutafanya hivyo): +```bash +#Get a message +az rest --method post \ +--uri "https://.servicebus.windows.net//messages/head?timeout=60" \ +--headers "Content-Type=application/atom+xml;type=entry;charset=utf-8" "Authorization=SharedAccessSignature sr=&sig=&se=&skn=" + +#Peek a message +az rest --method get \ +--uri "https://.servicebus.windows.net//messages/head?peekonly=true&timeout=60" \ +--headers "Authorization=SharedAccessSignature sr=&sig=&se=&skn=" + +#You can select the meesage changing the field PreviousSequenceNumber +az rest --method get \ +--uri "https://.servicebus.windows.net//messages?timeout=60&PreviousSequenceNumber=&api-version=2017-04" \ +--headers "Authorization=SharedAccessSignature sr=&sig=&se=&skn=" +``` +Please provide the text you would like translated to Swahili. +```bash +#Get a message +az rest --method post \ +--uri "https://.servicebus.windows.net//subscriptions//messages/head?timeout=60" \ +--headers "Content-Type=application/atom+xml;type=entry;charset=utf-8" "Authorization=SharedAccessSignature sr=&sig=&se=&skn=" + +#Peek a message +az rest --method get \ +--uri "https://.servicebus.windows.net//subscriptions//messages/head?timeout=60&api-version=2017-04" \ +--headers "Authorization=SharedAccessSignature sr=&sig=&se=&skn=" + +#You can select the meesage changing the field PreviousSequenceNumber +az rest --method get \ +--uri "https://.servicebus.windows.net//subscriptions//messages?timeout=60&PreviousSequenceNumber=&api-version=2017-04" \ +--headers "Authorization=SharedAccessSignature sr=&sig=&se=&skn=" +``` +### Tuma Ujumbe. DataActions: `Microsoft.ServiceBus/namespaces/messages/send/action` + +Unaweza kutumia ruhusa hii kutuma ujumbe, hata kama `--disable-local-auth` imewekwa kuwa kweli. +```python +import asyncio +from azure.identity.aio import DefaultAzureCredential +from azure.servicebus.aio import ServiceBusClient +from azure.servicebus import ServiceBusMessage + +NS = ".servicebus.windows.net" # Your namespace +QUEUE_OR_TOPIC = "" # Your queue name + +async def run(): +credential = DefaultAzureCredential() +async with ServiceBusClient(fully_qualified_namespace=NS, credential=credential) as client: +async with client.get_queue_sender(queue_name=QUEUE) as sender: +await sender.send_messages(ServiceBusMessage("Single Message")) +print("Sent a single message") +await credential.close() + +if __name__ == "__main__": +asyncio.run(run()) +``` +### Pokea Ujumbe. DataActions: `Microsoft.ServiceBus/namespaces/messages/receive/action` + +Unaweza kutumia ruhusa hii kupokea ujumbe, hata kama `--disable-local-auth` imewekwa kuwa kweli. +```python +import asyncio +from azure.identity.aio import DefaultAzureCredential +from azure.servicebus.aio import ServiceBusClient + +NS = ".servicebus.windows.net" +QUEUE = "" + +# For a topic subscription, uncomment and set these values: +# TOPIC = "" +# SUBSCRIPTION = "" + +async def run(): +credential = DefaultAzureCredential() +async with ServiceBusClient(fully_qualified_namespace=NS, credential=credential) as client: +# Receiving from a queue: +async with client.get_queue_receiver(queue_name=QUEUE, max_wait_time=5) as receiver: +async for msg in receiver: +print("Received from Queue:", msg) +await receiver.complete_message(msg) + +# To receive from a topic subscription, uncomment the code below and comment out the queue receiver above: +# async with client.get_subscription_receiver(topic_name=TOPIC, subscription_name=SUBSCRIPTION, max_wait_time=5) as receiver: +# async for msg in receiver: +# print("Received from Topic Subscription:", msg) +# await receiver.complete_message(msg) + +await credential.close() + +asyncio.run(run()) +print("Done receiving messages") ``` ## References -- https://learn.microsoft.com/en-us/azure/storage/queues/storage-powershell-how-to-use-queues -- https://learn.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api -- https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-attributes -- https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-python-how-to-use-topics-subscriptions?tabs=passwordless -- https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/integration#microsoftservicebus +- [https://learn.microsoft.com/en-us/azure/storage/queues/storage-powershell-how-to-use-queues](https://learn.microsoft.com/en-us/azure/storage/queues/storage-powershell-how-to-use-queues) +- [https://learn.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api](https://learn.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api) +- [https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-attributes](https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-attributes) +- [https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-python-how-to-use-topics-subscriptions?tabs=passwordless](https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-python-how-to-use-topics-subscriptions?tabs=passwordless) +- [https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/integration#microsoftservicebus](https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/integration#microsoftservicebus) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-sql-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-sql-privesc.md index 9984bfa6d..bbeb83397 100644 --- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-sql-privesc.md +++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-sql-privesc.md @@ -12,7 +12,7 @@ Kwa maelezo zaidi kuhusu SQL Database angalia: ### `Microsoft.Sql/servers/read` && `Microsoft.Sql/servers/write` -Kwa ruhusa hizi, mtumiaji anaweza kufanya kupandisha hadhi kwa kuboresha au kuunda Azure SQL servers na kubadilisha mipangilio muhimu, ikiwa ni pamoja na akcredentials za usimamizi. Ruhusa hii inamruhusu mtumiaji kuboresha mali za server, ikiwa ni pamoja na nenosiri la msimamizi wa SQL server, kuruhusu ufikiaji usioidhinishwa au udhibiti juu ya server. Wanaweza pia kuunda servers mpya, huenda wakileta miundombinu ya kivuli kwa madhumuni mabaya. Hii inakuwa muhimu hasa katika mazingira ambapo "Microsoft Entra Authentication Only" imezimwa, kwani wanaweza kutumia uthibitishaji wa SQL kupata ufikiaji usio na kikomo. +Kwa ruhusa hizi, mtumiaji anaweza kufanya kupandisha hadhi kwa kuboresha au kuunda Azure SQL servers na kubadilisha mipangilio muhimu, ikiwa ni pamoja na akcredentials za usimamizi. Ruhusa hii inamruhusu mtumiaji kuboresha mali za server, ikiwa ni pamoja na nenosiri la msimamizi wa SQL server, ikiruhusu ufikiaji usioidhinishwa au udhibiti juu ya server. Wanaweza pia kuunda servers mpya, huenda wakileta miundombinu ya kivuli kwa madhumuni mabaya. Hii inakuwa muhimu hasa katika mazingira ambapo "Microsoft Entra Authentication Only" imezimwa, kwani wanaweza kutumia uthibitishaji wa SQL kupata ufikiaji usio na kikomo. ```bash # Change the server password az sql server update \ @@ -26,7 +26,7 @@ az sql server create \ --resource-group \ --location \ --admin-user \ ---admin-password +--admin-password ``` Zaidi ya hayo, ni muhimu kuwa na ufikiaji wa umma ulioanzishwa ikiwa unataka kufikia kutoka kwa kiunganishi kisichokuwa cha kibinafsi, ili kuuwezesha: ```bash @@ -35,9 +35,34 @@ az sql server update \ --resource-group \ --enable-public-network true ``` +Zaidi ya hayo, kwa ruhusa unaweza kuwezesha kitambulisho kilichopewa, na kufanya kazi na kitambulisho kinachosimamiwa kilichounganishwa na seva. Kwa mfano hapa na kitambulisho kinachosimamiwa ambacho kinaweza kufikia Azure Storage: +```bash +az sql server update \ +--name \ +--resource-group \ +--assign_identity +``` + +```sql +CREATE EXTERNAL DATA SOURCE ManagedIdentity +WITH ( +TYPE = BLOB_STORAGE, +LOCATION = 'https://.blob.core.windows.net/', +CREDENTIAL = ManagedIdentityCredential +); +GO + +SELECT * +FROM OPENROWSET( +BULK 'message.txt', +DATA_SOURCE = 'ManagedIdentity', +SINGLE_CLOB +) AS DataFile; +GO +``` ### `Microsoft.Sql/servers/firewallRules/write` -Mshambuliaji anaweza kubadilisha sheria za firewall kwenye Azure SQL servers ili kuruhusu ufikiaji usioidhinishwa. Hii inaweza kutumika kufungua server kwa anwani maalum za IP au anuwai nzima za IP, ikiwa ni pamoja na IP za umma, ikiruhusu ufikiaji kwa wahusika wabaya. Shughuli hii ya baada ya kushambulia inaweza kutumika kupita udhibiti wa usalama wa mtandao uliopo, kuanzisha kudumu, au kuwezesha harakati za upande ndani ya mazingira kwa kufichua rasilimali nyeti. +Mshambuliaji anaweza kubadilisha sheria za firewall kwenye Azure SQL servers ili kuruhusu ufikiaji usioidhinishwa. Hii inaweza kutumika kufungua server kwa anwani maalum za IP au anuwai nzima za IP, ikiwa ni pamoja na IP za umma, ikiruhusu ufikiaji kwa wahusika wabaya. Shughuli hii ya baada ya mshambulizi inaweza kutumika kupita udhibiti wa usalama wa mtandao uliopo, kuanzisha kudumu, au kuwezesha harakati za upande ndani ya mazingira kwa kufichua rasilimali nyeti. ```bash # Create Firewall Rule az sql server firewall-rule create \ @@ -74,7 +99,7 @@ NOTE: Ni muhimu kuwa na ufikiaji wa umma ulioanzishwa ### `Microsoft.Sql/servers/administrators/write` && `Microsoft.Sql/servers/administrators/read` -Kwa ruhusa hizi unaweza privesc katika mazingira ya Azure SQL Server kwa kufikia database za SQL na kupata taarifa muhimu. Kwa kutumia amri iliyo hapa chini, mshambuliaji au mtumiaji aliyeidhinishwa anaweza kujipatia au kuweka akaunti nyingine kama msimamizi wa Azure AD. Ikiwa "Microsoft Entra Authentication Only" imeanzishwa unaweza kufikia server na mifano yake. Hapa kuna amri ya kuweka msimamizi wa Azure AD kwa server ya SQL: +Kwa ruhusa hizi unaweza privesc katika mazingira ya Azure SQL Server kwa kufikia hifadhidata za SQL na kupata taarifa muhimu. Kwa kutumia amri iliyo hapa chini, mshambuliaji au mtumiaji aliyeidhinishwa anaweza kujipatia au kuweka akaunti nyingine kama msimamizi wa Azure AD. Ikiwa "Microsoft Entra Authentication Only" imeanzishwa unaweza kufikia seva na matukio yake. Hapa kuna amri ya kuweka msimamizi wa Azure AD kwa seva ya SQL: ```bash az sql server ad-admin create \ --server \ @@ -84,7 +109,7 @@ az sql server ad-admin create \ ``` ### `Microsoft.Sql/servers/azureADOnlyAuthentications/write` && `Microsoft.Sql/servers/azureADOnlyAuthentications/read` -Kwa ruhusa hizi, unaweza kusanifu na kutekeleza "Microsoft Entra Authentication Only" kwenye Azure SQL Server, ambayo inaweza kusaidia kupandisha hadhi katika hali fulani. Mshambuliaji au mtumiaji aliyeidhinishwa mwenye ruhusa hizi anaweza kuwezesha au kuzima uthibitishaji wa Azure AD pekee. +Kwa ruhusa hizi, unaweza kuunda na kutekeleza "Microsoft Entra Authentication Only" kwenye Azure SQL Server, ambayo inaweza kusaidia kupandisha hadhi katika hali fulani. Mshambuliaji au mtumiaji aliyeidhinishwa mwenye ruhusa hizi anaweza kuwezesha au kuzima uthibitishaji wa Azure AD pekee. ```bash #Enable az sql server azure-ad-only-auth enable \ diff --git a/src/pentesting-cloud/azure-security/az-services/az-container-instances.md b/src/pentesting-cloud/azure-security/az-services/az-container-instances.md deleted file mode 100644 index 34ac62843..000000000 --- a/src/pentesting-cloud/azure-security/az-services/az-container-instances.md +++ /dev/null @@ -1,45 +0,0 @@ -# Az - Container Instances - -{{#include ../../../banners/hacktricks-training.md}} - -## Basic Information - -Azure Container Instances (ACI) hutoa njia **isiyo na seva, ya mahitaji** ya kuendesha **containers** katika wingu la Azure. Unaweza **kupeleka** container moja au nyingi katika kundi lenye **hesabu inayoweza kupanuka**, **chaguzi za mtandao**, na ufanisi wa kuungana na **huduma nyingine za Azure** (kama Hifadhi, Mitandao ya Kijadi, au Rejista za Container). - -Kwa kuwa ni **kazi za muda mfupi**, huhitaji kusimamia miundombinu ya VM ya msingi — Azure inashughulikia hiyo kwa ajili yako. Hata hivyo, kutoka kwa **mtazamo wa usalama wa mashambulizi**, ni muhimu kuelewa jinsi **idhini**, **vitambulisho**, **mipangilio ya mtandao**, na **kumbukumbu** zinaweza kufichua maeneo ya shambulio na uwezekano wa mipangilio isiyo sahihi. - -### Configurations - -- Ili kuunda container, inawezekana kutumia picha ya umma, picha ya container kutoka kwa Azure Container Registry au hifadhi ya nje, ambayo inaweza **kuhitaji kuunda nenosiri** ili kuipata. -- Kuhusu mtandao, inaweza pia kuwa na **IP ya umma** au kuwa **mipaka ya kibinafsi**. -- Pia inawezekana kuunda mipangilio ya kawaida ya docker kama: -- **Mabadiliko ya mazingira** -- **Volumes** (hata kutoka Azure Files) -- **Ports** -- **Mipaka ya CPU na kumbukumbu** -- **Sera ya kuanzisha upya** -- **Kimbia kama mwenye mamlaka** -- **Amri ya kuendesha** -- ... - -## Enumeration - -> [!WARNING] -> Unapokuwa unafanya orodha ya ACI, unaweza kufichua mipangilio nyeti kama **mabadiliko ya mazingira**, **maelezo ya mtandao**, au **vitambulisho vilivyodhibitiwa**. Kuwa makini na kuandika au kuonyesha hizo. -```bash -# List all container instances in the subscription -az container list - -# Show detailed information about a specific container instance -az container show --name --resource-group - -# Fetch logs from a container -az container logs --name --resource-group - -# Execute a command in a running container and get the output -az container exec --name --resource-group --exec-command "ls" - -# Get yaml configuration of the container group -az container export --name --resource-group -``` - diff --git a/src/pentesting-cloud/azure-security/az-services/az-queue-enum.md b/src/pentesting-cloud/azure-security/az-services/az-queue-enum.md index c9ad12f9b..fdcab7949 100644 --- a/src/pentesting-cloud/azure-security/az-services/az-queue-enum.md +++ b/src/pentesting-cloud/azure-security/az-services/az-queue-enum.md @@ -84,8 +84,8 @@ $queueMessage.Value ## Marejeo -- https://learn.microsoft.com/en-us/azure/storage/queues/storage-powershell-how-to-use-queues -- https://learn.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api -- https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-attributes +- [https://learn.microsoft.com/en-us/azure/storage/queues/storage-powershell-how-to-use-queues](https://learn.microsoft.com/en-us/azure/storage/queues/storage-powershell-how-to-use-queues) +- [https://learn.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api](https://learn.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api) +- [https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-attributes](https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-attributes) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/azure-security/az-services/az-servicebus-enum.md b/src/pentesting-cloud/azure-security/az-services/az-servicebus-enum.md index af399f9de..3fe26523f 100644 --- a/src/pentesting-cloud/azure-security/az-services/az-servicebus-enum.md +++ b/src/pentesting-cloud/azure-security/az-services/az-servicebus-enum.md @@ -4,50 +4,59 @@ ## Service Bus -Azure Service Bus ni **huduma ya ujumbe** inayotolewa kwenye wingu iliyoundwa kuwezesha **mawasiliano ya kuaminika kati ya sehemu tofauti za programu au programu tofauti**. Inafanya kazi kama katikati salama, kuhakikisha ujumbe unawasilishwa kwa usalama, hata kama mtumaji na mpokeaji hawafanyi kazi kwa wakati mmoja. Kwa kutenganisha mifumo, inaruhusu programu kufanya kazi kwa uhuru huku bado ikibadilishana data au maagizo. Ni muhimu hasa kwa hali zinazohitaji usawa wa mzigo kati ya wafanyakazi wengi, utoaji wa ujumbe wa kuaminika, au uratibu mgumu, kama vile kusindika kazi kwa mpangilio au kusimamia ufikiaji kwa usalama. +Azure Service Bus ni **huduma ya ujumbe** inayotolewa kwenye wingu iliyoundwa kuwezesha **mawasiliano ya kuaminika kati ya sehemu tofauti za programu au programu tofauti**. Inafanya kazi kama katikati salama, kuhakikisha ujumbe unawasilishwa kwa usalama, hata kama mtumaji na mpokeaji hawafanyi kazi kwa wakati mmoja. Kwa kutenganisha mifumo, inaruhusu programu kufanya kazi kwa uhuru huku bado zikibadilishana data au maagizo. Ni muhimu hasa kwa hali zinazohitaji usawa wa mzigo kati ya wafanyakazi wengi, utoaji wa ujumbe wa kuaminika, au uratibu mgumu, kama vile kusindika kazi kwa mpangilio au kusimamia ufikiaji kwa usalama. ### Key Concepts -1. **Queues:** kusudi lake ni kuhifadhi ujumbe hadi mpokeaji awe tayari. +1. **Namespaces:** Namespace katika mifumo ya ujumbe ni chombo cha kimantiki kinachopanga na kusimamia vipengele vya ujumbe, foleni na mada. Inatoa mazingira yaliyotengwa ambapo programu zinaweza kutuma, kupokea, na kusindika ujumbe. Foleni na mada zinashiriki miundombinu na usanidi sawa ndani ya namespace ya Service Bus, lakini zinafanya kazi kwa uhuru bila kuingiliana. +2. **Queues:** kusudi lake ni kuhifadhi ujumbe hadi mpokeaji awe tayari. - Ujumbe umeagizwa, umewekwa alama ya muda, na kuhifadhiwa kwa kudumu. -- Utoaji unafanyika kwa njia ya kuvuta (urejeshaji kwa ombi). +- Utoaji unafanyika kwa njia ya kuvuta (urejeshaji kwa mahitaji). - Inasaidia mawasiliano ya pointi-kwa-point. -2. **Topics:** Ujumbe wa kuchapisha-na-kujiandikisha kwa matangazo. +3. **Topics:** Ujumbe wa kuchapisha-na-kujiandikisha kwa matangazo. - Usajili wengi huru hupokea nakala za ujumbe. - Usajili unaweza kuwa na sheria/filter za kudhibiti utoaji au kuongeza metadata. - Inasaidia mawasiliano ya wengi-kwa-wengi. -3. **Namespaces:** Chombo kwa ajili ya vipengele vyote vya ujumbe, foleni na mada, ni kama kipande chako cha klasta yenye nguvu ya Azure, ikitoa uwezo maalum na kwa hiari inapanuka katika maeneo matatu ya upatikanaji. -### Advance Features +Mstari wa mwisho wa huduma ya bus/kiungo ni: +```bash +https://.servicebus.windows.net:443/ +``` +### Vipengele vya Juu -Baadhi ya vipengele vya juu ni: +Vipengele vya juu ni: - **Message Sessions**: Inahakikisha usindikaji wa FIFO na inasaidia mifumo ya ombi-jibu. -- **Auto-Forwarding**: Inahamisha ujumbe kati ya foleni au mada katika namespace moja. -- **Dead-Lettering**: Inakamata ujumbe ambao hauwezi kuwasilishwa kwa ajili ya mapitio. +- **Auto-Forwarding**: Inahamisha ujumbe kati ya foleni au mada katika eneo moja. +- **Dead-Lettering**: Inakamata ujumbe ambao hauwezi kufikishwa kwa ajili ya mapitio. - **Scheduled Delivery**: Inachelewesha usindikaji wa ujumbe kwa kazi za baadaye. -- **Message Deferral**: Inachelewesha urejeshaji wa ujumbe hadi iwe tayari. -- **Transactions**: Inakusanya operesheni katika utekelezaji wa atomiki. +- **Message Deferral**: Inachelewesha upatikanaji wa ujumbe hadi iwe tayari. +- **Transactions**: Inakusanya operesheni katika utekelezaji wa atomic. - **Filters & Actions**: Inatumia sheria kuchuja au kuongeza maelezo kwenye ujumbe. -- **Auto-Delete on Idle**: Inafuta foleni baada ya kutokuwepo kwa shughuli (min: dakika 5). -- **Duplicate Detection**: Inafuta ujumbe wa nakala wakati wa kutuma tena. -- **Batch Deletion**: Inafuta kwa wingi ujumbe walioisha muda au wasio na umuhimu. +- **Auto-Delete on Idle**: Inafuta foleni baada ya kutokuwa na shughuli (min: dakika 5). +- **Duplicate Detection**: Inatoa ujumbe wa nakala wakati wa kutuma tena. +- **Batch Deletion**: Inafuta kwa wingi ujumbe ambao umepita muda au si wa lazima. ### Authorization-Rule / SAS Policy -Sera za SAS zinafafanua ruhusa za ufikiaji kwa vitu vya Azure Service Bus namespace (Muhimu Zaidi), foleni na mada. Kila sera ina vipengele vifuatavyo: +Sera za SAS zinaelezea ruhusa za ufikiaji kwa vitu vya Azure Service Bus (Jambo Muhimu Zaidi), foleni na mada. Kila sera ina vipengele vifuatavyo: - **Permissions**: Sanduku za kuangalia kubaini viwango vya ufikiaji: -- Manage: Inatoa udhibiti kamili juu ya chombo, ikiwa ni pamoja na usimamizi wa usanidi na ruhusa. -- Send: Inaruhusu kutuma ujumbe kwa chombo. -- Listen: Inaruhusu kupokea ujumbe kutoka kwa chombo. +- Manage: Inatoa udhibiti kamili juu ya kitu, ikiwa ni pamoja na usanidi na usimamizi wa ruhusa. +- Send: Inaruhusu kutuma ujumbe kwa kitu. +- Listen: Inaruhusu kupokea ujumbe kutoka kwa kitu. - **Primary and Secondary Keys**: Hizi ni funguo za kificho zinazotumika kutengeneza tokeni salama za kuthibitisha ufikiaji. -- **Primary and Secondary Connection Strings**: Nyimbo za muunganisho zilizowekwa awali ambazo zinajumuisha mwisho na funguo kwa matumizi rahisi katika programu. -- **SAS Policy ARM ID**: Njia ya Meneja Rasilimali ya Azure (ARM) kwa sera kwa ajili ya utambulisho wa kimaandishi. +- **Primary and Secondary Connection Strings**: Nyuzi za muunganisho zilizopangwa awali ambazo zinajumuisha mwisho na funguo kwa matumizi rahisi katika programu. +- **SAS Policy ARM ID**: Njia ya Meneja Rasilimali ya Azure (ARM) kwa sera kwa ajili ya utambuzi wa kimaandishi. -### NameSpace +Ni muhimu kutambua kwamba eneo lina sera moja ya SAS ambayo inaathiri kila kitu ndani yake, wakati foleni na mada zinaweza kuwa na sera zao za SAS za kibinafsi kwa udhibiti wa kina zaidi. -sku, sheria ya uthibitishaji, +### "--disable-local-auth" + +Parameta --disable-local-auth inatumika kudhibiti ikiwa uthibitishaji wa ndani (yaani, kutumia funguo za Shared Access Signature (SAS)) umewezeshwa kwa eneo lako la Service Bus. Hapa kuna unachohitaji kujua: + +- Wakati imewekwa kuwa kweli: Uthibitishaji wa ndani kwa kutumia funguo za SAS umezimwa na uthibitishaji wa Azure Active Directory (Azure AD) unaruhusiwa. +- Wakati imewekwa kuwa uongo: Uthibitishaji wa SAS (wa ndani) na uthibitishaji wa Azure AD vinapatikana na unaweza kutumia nyuzi za muunganisho na funguo za SAS kufikia rasilimali zako za Service Bus. ### Enumeration @@ -140,7 +149,7 @@ Get-AzServiceBusTopic -ResourceGroupName -NamespaceName --resource-group ## List Server Firewalls @@ -231,20 +285,20 @@ Unaweza pia kutumia sqlcmd kufikia hifadhidata. Ni muhimu kujua ikiwa seva inaru ```bash sqlcmd -S .database.windows.net -U -P -d ``` -## Marejeo +## References - [https://learn.microsoft.com/en-us/azure/azure-sql/azure-sql-iaas-vs-paas-what-is-overview?view=azuresql](https://learn.microsoft.com/en-us/azure/azure-sql/azure-sql-iaas-vs-paas-what-is-overview?view=azuresql) - [https://learn.microsoft.com/en-us/azure/azure-sql/database/single-database-overview?view=azuresql](https://learn.microsoft.com/en-us/azure/azure-sql/database/single-database-overview?view=azuresql) - [https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview?view=azuresql](https://learn.microsoft.com/en-us/azure/azure-sql/managed-instance/sql-managed-instance-paas-overview?view=azuresql) - [https://learn.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview?view=azuresql](https://learn.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/sql-server-on-azure-vm-iaas-what-is-overview?view=azuresql) -## Kuinua Mamlaka +## Privilege Escalation {{#ref}} ../az-privilege-escalation/az-sql-privesc.md {{#endref}} -## Baada ya Utekelezaji +## Post Exploitation {{#ref}} ../az-post-exploitation/az-sql-post-exploitation.md diff --git a/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-compute-instance.md b/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-compute-instance.md index fd0efd14a..8c9687465 100644 --- a/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-compute-instance.md +++ b/src/pentesting-cloud/gcp-security/gcp-services/gcp-compute-instances-enum/gcp-compute-instance.md @@ -4,11 +4,11 @@ ## Basic Information -Google Cloud Compute Instances ni **mashine za kawaida za virtual kwenye miundombinu ya wingu ya Google**, zinazotoa nguvu za kompyuta zinazoweza kupanuliwa na zinazohitajika kwa anuwai ya matumizi. Zinatoa vipengele kama vile usambazaji wa kimataifa, uhifadhi wa kudumu, chaguzi za OS zinazoweza kubadilishwa, na ushirikiano mzuri wa mtandao na usalama, na kuifanya kuwa chaguo bora kwa kuhost tovuti, kuchakata data, na kuendesha programu kwa ufanisi katika wingu. +Google Cloud Compute Instances ni **mashine za virtual zinazoweza kubadilishwa kwenye miundombinu ya wingu ya Google**, zinazotoa nguvu za kompyuta zinazoweza kupanuliwa na zinazohitajika kwa anuwai ya matumizi. Zinatoa vipengele kama vile uhamasishaji wa kimataifa, uhifadhi wa kudumu, chaguo za OS zinazoweza kubadilishwa, na ushirikiano mzuri wa mtandao na usalama, na kuifanya kuwa chaguo bora kwa kuhost tovuti, kuchakata data, na kuendesha programu kwa ufanisi katika wingu. ### Confidential VM -Confidential VMs hutumia **vipengele vya usalama vinavyotegemea vifaa** vinavyotolewa na kizazi kipya cha AMD EPYC processors, ambacho kinajumuisha usimbuaji wa kumbukumbu na uhalalishaji wa usimbuaji salama. Vipengele hivi vinamwezesha VM kulinda data inayochakatwa na kuhifadhiwa ndani yake hata kutoka kwa mfumo wa uendeshaji wa mwenyeji na hypervisor. +Confidential VMs hutumia **vipengele vya usalama vinavyotegemea vifaa** vinavyotolewa na kizazi kipya cha AMD EPYC processors, ambacho kinajumuisha usimbaji wa kumbukumbu na uhalisia wa usimbaji salama. Vipengele hivi vinamwezesha VM kulinda data inayochakatwa na kuhifadhiwa ndani yake hata kutoka kwa mfumo wa uendeshaji wa mwenyeji na hypervisor. Ili kuendesha Confidential VM inaweza kuhitaji **kubadilisha** mambo kama vile **aina** ya **mashine**, **kiunganishi** cha mtandao, **picha ya diski ya kuanzisha**. @@ -19,12 +19,12 @@ Inawezekana **kuchagua diski** ya kutumia au **kuunda mpya**. Ikiwa unachagua mp - Kuchagua **ukubwa** wa diski - Kuchagua **OS** - Kuonyesha ikiwa unataka **kufuta diski wakati mfano unafutwa** -- **Usimbuaji**: Kwa **kawaida** funguo ya **Google inayosimamiwa** itatumika, lakini unaweza pia **kuchagua funguo kutoka KMS** au kuonyesha **funguo mbichi za kutumia**. +- **Usimbaji**: Kwa **kawaida** funguo **zinazosimamiwa na Google** zitatumika, lakini unaweza pia **kuchagua funguo kutoka KMS** au kuonyesha **funguo za kawaida za kutumia**. ### Deploy Container -Inawezekana kupeleka **container** ndani ya mashine ya virtual.\ -Inawezekana kusanidi **picha** ya kutumia, kuweka **amri** ya kuendesha ndani, **hoja**, kuunganisha **kiasi**, na **mabadiliko ya env** (habari nyeti?) na kusanidi chaguzi kadhaa kwa ajili ya container hii kama kuendesha kama **mwenye mamlaka**, stdin na pseudo TTY. +Inawezekana kupeleka **konteina** ndani ya mashine ya virtual.\ +Inawezekana kusanidi **picha** ya kutumia, kuweka **amri** ya kuendesha ndani, **hoja**, kuunganisha **kiasi**, na **mabadiliko ya mazingira** (habari nyeti?) na kusanidi chaguzi kadhaa kwa ajili ya konteina hii kama kuendesha kama **mwenye mamlaka**, stdin na pseudo TTY. ### Service Account @@ -34,13 +34,13 @@ Akaunti hii ya huduma ina **nafasi ya Mhariri juu ya mradi mzima (mamlaka ya juu Na **mipaka ya ufikiaji ya kawaida** ni zifuatazo: - **https://www.googleapis.com/auth/devstorage.read\_only** -- Ufikiaji wa kusoma kwenye ndoo :) -- https://www.googleapis.com/auth/logging.write -- https://www.googleapis.com/auth/monitoring.write -- https://www.googleapis.com/auth/servicecontrol -- https://www.googleapis.com/auth/service.management.readonly -- https://www.googleapis.com/auth/trace.append +- [https://www.googleapis.com/auth/logging.write](https://www.googleapis.com/auth/logging.write) +- [https://www.googleapis.com/auth/monitoring.write](https://www.googleapis.com/auth/monitoring.write) +- [https://www.googleapis.com/auth/servicecontrol](https://www.googleapis.com/auth/servicecontrol) +- [https://www.googleapis.com/auth/service.management.readonly](https://www.googleapis.com/auth/service.management.readonly) +- [https://www.googleapis.com/auth/trace.append](https://www.googleapis.com/auth/trace.append) -Hata hivyo, inawezekana **kutoa `cloud-platform` kwa kubonyeza** au kubainisha **za kawaida**. +Hata hivyo, inawezekana **kuipa `cloud-platform` kwa kubonyeza** au kubainisha **za kawaida**.
@@ -54,13 +54,13 @@ Inawezekana kuruhusu trafiki ya HTTP na HTTPS. - **IP Forwarding**: Inawezekana **kuwezesha IP forwarding** kutoka kwa uundaji wa mfano. - **Hostname**: Inawezekana kutoa mfano jina la kudumu. -- **Interface**: Inawezekana kuongeza kiunganishi cha mtandao +- **Interface**: Inawezekana kuongeza kiunganishi cha mtandao. ### Extra Security Chaguzi hizi zitafanya **kuongeza usalama** wa VM na zinapendekezwa: -- **Secure boot:** Secure boot husaidia kulinda mfano wako wa VM dhidi ya malware na rootkits za kiwango cha kuanzisha na kernel. +- **Secure boot:** Secure boot husaidia kulinda mfano wako wa VM dhidi ya malware na rootkits za kiwango cha kuanzisha na kiwango cha kernel. - **Enable vTPM:** Virtual Trusted Platform Module (vTPM) inathibitisha uhalali wa VM yako ya wageni kabla ya kuanzisha na uhalali wa kuanzisha, na inatoa kizazi na ulinzi wa funguo. - **Integrity supervision:** Ufuatiliaji wa uaminifu unakuwezesha kufuatilia na kuthibitisha uhalali wa kuanzisha wa wakati wa kuendesha wa mfano wako wa VM uliohifadhiwa kwa kutumia ripoti za Stackdriver. Inahitaji vTPM iwe imewezeshwa. @@ -76,7 +76,7 @@ Wakati **huduma** hii ime **wezeshwa**, ufikiaji kupitia **funguo za SSH umezuil Inawezekana kufafanua **automatisering** (userdata katika AWS) ambayo ni **amri za shell** ambazo zitatekelezwa kila wakati mashine inapoanzishwa au kuanzishwa upya. -Pia inawezekana **kuongeza funguo za metadata za ziada** ambazo zitakuwa zinapatikana kutoka kwa kiunganishi cha metadata. Habari hii kawaida hutumika kwa mabadiliko ya mazingira na scripts za kuanzisha/kuzima. Hii inaweza kupatikana kwa kutumia **`describe` method** kutoka kwa amri katika sehemu ya uainishaji, lakini pia inaweza kupatikana kutoka ndani ya mfano kwa kufikia kiunganishi cha metadata. +Pia inawezekana **kuongeza funguo za metadata za ziada** ambazo zitapatikana kutoka kwa kiunganishi cha metadata. Habari hii kawaida hutumika kwa mabadiliko ya mazingira na scripts za kuanzisha/kuzima. Hii inaweza kupatikana kwa kutumia **`describe` method** kutoka kwa amri katika sehemu ya uainishaji, lakini pia inaweza kupatikana kutoka ndani ya mfano kwa kufikia kiunganishi cha metadata. ```bash # view project metadata curl "http://metadata.google.internal/computeMetadata/v1/project/attributes/?recursive=true&alt=text" \ @@ -86,7 +86,7 @@ curl "http://metadata.google.internal/computeMetadata/v1/project/attributes/?rec curl "http://metadata.google.internal/computeMetadata/v1/instance/attributes/?recursive=true&alt=text" \ -H "Metadata-Flavor: Google" ``` -Zaidi ya hayo, **token ya uthibitisho kwa akaunti ya huduma iliyoambatanishwa** na **taarifa za jumla** kuhusu mfano, mtandao na mradi pia zitapatikana kutoka **kituo cha metadata**. Kwa maelezo zaidi angalia: +Zaidi ya hayo, **token ya uthibitishaji kwa akaunti ya huduma iliyoambatanishwa** na **taarifa za jumla** kuhusu mfano, mtandao na mradi pia zitapatikana kutoka kwa **metadata endpoint**. Kwa maelezo zaidi angalia: {{#ref}} https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#gcp @@ -94,7 +94,7 @@ https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/ ### Ulinzi wa Takwimu -Funguo ya ulinzi wa takwimu inayosimamiwa na Google inatumika kama chaguo-msingi lakini funguo ya ulinzi wa takwimu inayosimamiwa na Mteja (CMEK) inaweza kuwekwa. Unaweza pia kuweka mipango ya kufanya nini wakati CMEK inayotumika inabatilishwa: Kurekodi au kuzima VM. +Funguo za ulinzi wa takwimu zinazodhibitiwa na Google hutumiwa kama chaguo-msingi lakini funguo za ulinzi wa takwimu zinazodhibitiwa na Mteja (CMEK) zinaweza kuanzishwa. Unaweza pia kuanzisha nini cha kufanya wakati CMEK inayotumika inatenguliwa: Kurekodi au kuzima VM.