mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2026-02-05 19:32:24 -08:00
Translated ['src/pentesting-cloud/azure-security/README.md'] to sw
This commit is contained in:
Translator
@@ -417,15 +417,18 @@
|
||||
- [Az - Container Registry](pentesting-cloud/azure-security/az-services/az-container-registry.md)
|
||||
- [Az - Container Instances, Apps & Jobs](pentesting-cloud/azure-security/az-services/az-container-instances-apps-jobs.md)
|
||||
- [Az - CosmosDB](pentesting-cloud/azure-security/az-services/az-cosmosDB.md)
|
||||
- [Az - Intune](pentesting-cloud/azure-security/az-services/intune.md)
|
||||
- [Az - Defender](pentesting-cloud/azure-security/az-services/az-defender.md)
|
||||
- [Az - File Shares](pentesting-cloud/azure-security/az-services/az-file-shares.md)
|
||||
- [Az - Function Apps](pentesting-cloud/azure-security/az-services/az-function-apps.md)
|
||||
- [Az - Intune](pentesting-cloud/azure-security/az-services/intune.md)
|
||||
- [Az - Key Vault](pentesting-cloud/azure-security/az-services/az-keyvault.md)
|
||||
- [Az - Logic Apps](pentesting-cloud/azure-security/az-services/az-logic-apps.md)
|
||||
- [Az - Management Groups, Subscriptions & Resource Groups](pentesting-cloud/azure-security/az-services/az-management-groups-subscriptions-and-resource-groups.md)
|
||||
- [Az - Monitoring](pentesting-cloud/azure-security/az-services/az-monitoring.md)
|
||||
- [Az - MySQL](pentesting-cloud/azure-security/az-services/az-mysql.md)
|
||||
- [Az - PostgreSQL](pentesting-cloud/azure-security/az-services/az-postgresql.md)
|
||||
- [Az - Queue Storage](pentesting-cloud/azure-security/az-services/az-queue.md)
|
||||
- [Az - Sentinel](pentesting-cloud/azure-security/az-services/az-sentinel.md)
|
||||
- [Az - Service Bus](pentesting-cloud/azure-security/az-services/az-servicebus.md)
|
||||
- [Az - SQL](pentesting-cloud/azure-security/az-services/az-sql.md)
|
||||
- [Az - Static Web Applications](pentesting-cloud/azure-security/az-services/az-static-web-apps.md)
|
||||
|
||||
@@ -12,13 +12,13 @@ az-basic-information/
|
||||
|
||||
## Azure Pentester/Red Team Methodology
|
||||
|
||||
Ili kukagua mazingira ya AZURE ni muhimu sana kujua: ni **huduma zipi zinatumika**, nini kinacho **onyeshwa**, nani ana **ufikiaji** wa nini, na jinsi huduma za ndani za Azure na **huduma za nje** zinavyounganishwa.
|
||||
Ili kukagua mazingira ya AZURE ni muhimu sana kujua: ni **huduma zipi zinatumika**, nini kinachoweza **kuonyeshwa**, nani ana **ufikiaji** wa nini, na jinsi huduma za ndani za Azure na **huduma za nje** zinavyounganishwa.
|
||||
|
||||
Kutoka kwa mtazamo wa Red Team, **hatua ya kwanza ya kuathiri mazingira ya Azure** ni kufanikiwa kupata **mwanzo**.
|
||||
|
||||
### External enum & Initial Access
|
||||
|
||||
Hatua ya kwanza ni bila shaka kuhesabu taarifa kuhusu mpangilio unayoshambulia na kujaribu kupata mwanzo.
|
||||
Hatua ya kwanza ni bila shaka kuorodhesha taarifa kuhusu mpangilio unao shambulia na kujaribu kupata mwanzo.
|
||||
|
||||
Kulingana na jina la kikoa, inawezekana kujua **kama kampuni inatumia Azure**, kupata **tenant ID**, kupata **viwango vingine halali** katika mpangilio huo (ikiwa vipo) na kupata **taarifa muhimu** kama SSO imewezeshwa, mipangilio ya barua, barua pepe za watumiaji halali...
|
||||
|
||||
@@ -31,7 +31,7 @@ az-unauthenticated-enum-and-initial-entry/
|
||||
Kwa taarifa hii, njia za kawaida za kujaribu kupata mwanzo ni:
|
||||
- **OSINT**: Angalia kwa **leaks** katika Github au jukwaa lolote la chanzo wazi ambalo linaweza kuwa na **credentials** au taarifa za kuvutia.
|
||||
- **Password** reuse, leaks au [password spraying](az-unauthenticated-enum-and-initial-entry/az-password-spraying.md)
|
||||
- Nunua credentials kutoka kwa mfanyakazi
|
||||
- Nunua credentials za mfanyakazi
|
||||
- [**Common Phishing**](https://book.hacktricks.wiki/en/generic-methodologies-and-resources/phishing-methodology/index.html) (credentials au Oauth App)
|
||||
- [Device Code Authentication Phishing](az-unauthenticated-enum-and-initial-entry/az-device-code-authentication-phishing.md)
|
||||
- 3rd parties **breached**
|
||||
@@ -39,21 +39,21 @@ Kwa taarifa hii, njia za kawaida za kujaribu kupata mwanzo ni:
|
||||
- [**Server Side Request Forgery**](https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html) yenye ufikiaji wa metadata endpoint
|
||||
- **Subdomain takeovers** kama ilivyo katika [https://godiego.co/posts/STO-Azure/](https://godiego.co/posts/STO-Azure/)
|
||||
- **Mikosefu mingine ya huduma za azure**
|
||||
- Ikiwa kompyuta ya mende imeathiriwa ([WinPEAS na LinPEAS](https://github.com/peass-ng/PEASS-ng) zinaweza kupata taarifa hii):
|
||||
- Ikiwa kompyuta ya mende ya developer imeathiriwa ([WinPEAS na LinPEAS](https://github.com/peass-ng/PEASS-ng) zinaweza kupata taarifa hii):
|
||||
- Ndani ya **`<HOME>/.Azure`**
|
||||
- **`azureProfile.json`** ina taarifa kuhusu watumiaji walioingia kutoka zamani
|
||||
- **`clouds.config contains`** taarifa kuhusu usajili
|
||||
- **`service_principal_entries.json`** ina credentials za maombi (tenant id, clients na siri). Tu katika Linux & macOS
|
||||
- **`msal_token_cache.json`** ina tokens za ufikiaji na tokens za upya. Tu katika Linux & macOS
|
||||
- **`msal_token_cache.json`** ina tokens za ufikiaji na tokens za kurefresh. Tu katika Linux & macOS
|
||||
- **`service_principal_entries.bin`** na msal_token_cache.bin zinatumika katika Windows na zimefungwa kwa DPAPI
|
||||
- **`msal_http_cache.bin`** ni cache ya ombi la HTTP
|
||||
- Load it: `with open("msal_http_cache.bin", 'rb') as f: pickle.load(f)`
|
||||
- **`AzureRmContext.json`** ina taarifa kuhusu kuingia kwa awali kwa kutumia Az PowerShell (lakini hakuna credentials)
|
||||
- **`AzureRmContext.json`** ina taarifa kuhusu kuingia kwa awali kutumia Az PowerShell (lakini hakuna credentials)
|
||||
- Ndani ya **`C:\Users\<username>\AppData\Local\Microsoft\IdentityCache\*`** kuna faili kadhaa za `.bin` zenye **access tokens**, ID tokens na taarifa za akaunti zilizofungwa kwa DPAPI ya watumiaji.
|
||||
- Inawezekana kupata **access tokens** zaidi katika faili za `.tbres` ndani ya **`C:\Users\<username>\AppData\Local\Microsoft\TokenBroken\Cache\`** ambazo zina base64 iliyofungwa kwa DPAPI yenye access tokens.
|
||||
- Katika Linux na macOS unaweza kupata **access tokens, refresh tokens na id tokens** kutoka Az PowerShell (ikiwa imetumika) ukikimbia `pwsh -Command "Save-AzContext -Path /tmp/az-context.json"`
|
||||
- Katika Windows hii inazalisha tu id tokens.
|
||||
- Inawezekana kuona kama Az PowerShell ilitumika katika Linux na macOS kwa kuangalia kama `$HOME/.local/share/.IdentityService/` ipo (ingawa faili zilizomo ni tupu na hazina maana)
|
||||
- Inawezekana kuona kama Az PowerShell ilitumika katika Linux na macOS kwa kuangalia kama `$HOME/.local/share/.IdentityService/` ipo (ingawa faili zilizomo ni tupu na hazina matumizi)
|
||||
|
||||
Pata **mikosefu mingine ya Huduma za Azure** ambayo inaweza kupelekea mwanzo katika ukurasa ufuatao:
|
||||
|
||||
@@ -62,11 +62,11 @@ az-unauthenticated-enum-and-initial-entry/
|
||||
{{#endref}}
|
||||
|
||||
> [!NOTE]
|
||||
> Kumbuka kwamba kawaida sehemu ya **kelele** ya kuhesabu ni **kuingia**, si kuhesabu yenyewe.
|
||||
> Kumbuka kwamba kawaida sehemu ya **kelele** katika orodha ni **kuingia**, si orodha yenyewe.
|
||||
|
||||
### Azure & Entra ID tooling
|
||||
|
||||
Zana zifuatazo zitakuwa muhimu sana kuhesabu wapangilio wa Entra ID na mazingira ya Azure polepole (ili kuepuka kugunduliwa) au kiotomatiki (ili kuokoa muda):
|
||||
Zana zifuatazo zitakuwa muhimu sana kuorodhesha wapangilio wa Entra ID na mazingira ya Azure polepole (ili kuepuka kugundulika) au kiotomatiki (ili kuokoa muda):
|
||||
|
||||
{{#ref}}
|
||||
az-enumeration-tools.md
|
||||
@@ -79,11 +79,11 @@ az-enumeration-tools.md
|
||||
Katika kesi ambapo una credentials halali lakini huwezi kuingia, hizi ni baadhi ya ulinzi wa kawaida ambao unaweza kuwepo:
|
||||
|
||||
- **IP whitelisting** -- Unahitaji kuathiri IP halali
|
||||
- **Geo restrictions** -- Pata mahali ambapo mtumiaji anaishi au ofisi za kampuni na pata IP kutoka jiji moja (au nchi angalau)
|
||||
- **Geo restrictions** -- Pata mahali ambapo mtumiaji anaishi au ofisi za kampuni na pata IP kutoka jiji hilo hilo (au nchi angalau)
|
||||
- **Browser** -- Huenda ni kivinjari tu kutoka OS fulani (Windows, Linux, Mac, Android, iOS) kinachoruhusiwa. Jua ni OS ipi ambayo mwathirika/kampuni inatumia.
|
||||
- Unaweza pia kujaribu **kuathiri credentials za Service Principal** kwani kawaida hazina mipaka mingi na kuingia kwake hakuchunguzwi sana
|
||||
- Unaweza pia kujaribu **kuathiri credentials za Service Principal** kwani kawaida huwa na mipaka kidogo na kuingia kwake hakuchunguzwi sana
|
||||
|
||||
Baada ya kupita, unaweza kuwa na uwezo wa kurudi kwenye mipangilio yako ya awali na bado utakuwa na ufikiaji.
|
||||
Baada ya kupita, unaweza kurudi kwenye mipangilio yako ya awali na bado utakuwa na ufikiaji.
|
||||
|
||||
Angalia:
|
||||
|
||||
@@ -143,14 +143,14 @@ Get-AzureADTenantDetail
|
||||
|
||||
### Entra ID Enumeration & Privesc
|
||||
|
||||
Kwa kawaida, mtumiaji yeyote anapaswa kuwa na **idhini za kutosha kuhesabu** mambo kama watumiaji, vikundi, majukumu, wahusika wa huduma... (angalia [idhini za kawaida za AzureAD](az-basic-information/index.html#default-user-permissions)).\
|
||||
Kwa kawaida, mtumiaji yeyote anapaswa kuwa na **idhini za kutosha kuorodhesha** mambo kama watumiaji, vikundi, majukumu, wahusika wa huduma... (angalia [default AzureAD permissions](az-basic-information/index.html#default-user-permissions)).\
|
||||
Unaweza kupata hapa mwongozo:
|
||||
|
||||
{{#ref}}
|
||||
az-services/az-azuread.md
|
||||
{{#endref}}
|
||||
|
||||
Angalia **Zana za Post-Exploitation** ili kupata zana za kupandisha mamlaka katika Entra ID kama **AzureHound:**
|
||||
Angalia **Zana za Post-Exploitation** ili kupata zana za kupandisha hadhi katika Entra ID kama **AzureHound:**
|
||||
|
||||
{{#ref}}
|
||||
az-enumeration-tools.md#automated-post-exploitation-tools
|
||||
@@ -159,11 +159,14 @@ az-enumeration-tools.md#automated-post-exploitation-tools
|
||||
|
||||
### Azure Enumeration
|
||||
|
||||
Mara tu unavyojua wewe ni nani, unaweza kuanza kuhesabu **huduma za Azure unazoweza kufikia**.
|
||||
Mara tu unavyojua wewe ni nani, unaweza kuanza kuorodhesha **huduma za Azure unazofikia**.
|
||||
|
||||
Unapaswa kuanza kugundua **idhini ulizonazo** juu ya rasilimali. Kwa hili:
|
||||
|
||||
1. **Pata rasilimali unazoweza kufikia**:
|
||||
1. **Pata rasilimali unayo ufikia**:
|
||||
|
||||
> [!TIP]
|
||||
> Hii haitahitaji idhini maalum yoyote.
|
||||
|
||||
Amri ya Az PowerShell **`Get-AzResource`** inakuwezesha **kujua rasilimali ambazo mtumiaji wako wa sasa anaonekana nazo**.
|
||||
|
||||
@@ -171,61 +174,78 @@ Zaidi ya hayo, unaweza kupata taarifa hiyo hiyo katika **konsoli ya wavuti** kwa
|
||||
```bash
|
||||
az rest --method GET --url "https://management.azure.com/subscriptions/<subscription-id>/resources?api-version=2021-04-01"
|
||||
```
|
||||
2. **Pata ruhusa ulizonazo juu ya rasilimali ulizo na ufikiaji nazo na pata majukumu yaliyokuwekwa**:
|
||||
2. **Pata ruhusa ulizonazo juu ya rasilimali unazoweza kuona**:
|
||||
|
||||
Kumbuka kwamba unahitaji ruhusa **`Microsoft.Authorization/roleAssignments/read`** ili kutekeleza hatua hii.
|
||||
> [!TIP]
|
||||
> Hii haitahitaji ruhusa maalum yoyote.
|
||||
|
||||
Zaidi ya hayo, kwa ruhusa za kutosha, jukumu **`Get-AzRoleAssignment`** linaweza kutumika **kuorodhesha majukumu yote** katika usajili au ruhusa juu ya rasilimali maalum ikionyesha kama ifuatavyo:
|
||||
Kwa kuzungumza na API **`https://management.azure.com/{resource_id}/providers/Microsoft.Authorization/permissions?api-version=2022-04-01`** unaweza kupata ruhusa ulizonazo juu ya rasilimali iliyoainishwa katika **`resource_id`**.
|
||||
|
||||
Hivyo, **ukikagua kila moja ya rasilimali ulizonazo**, unaweza kupata ruhusa ulizonazo juu yao.
|
||||
|
||||
> [!WARNING]
|
||||
> Unaweza kujiandaa kwa hii kwa kutumia chombo **[Find_My_Az_Management_Permissions](https://github.com/carlospolop/Find_My_Az_Management_Permissions)**.
|
||||
|
||||
|
||||
<details>
|
||||
<summary>Orodhesha ruhusa kwa **`Microsoft.Authorization/roleAssignments/read`**</summary>
|
||||
|
||||
> [!TIP]
|
||||
> Kumbuka kwamba unahitaji ruhusa **`Microsoft.Authorization/roleAssignments/read`** ili kutekeleza hatua hii.
|
||||
|
||||
- Kwa ruhusa za kutosha, jukumu **`Get-AzRoleAssignment`** linaweza kutumika ili **kuorodhesha majukumu yote** katika usajili au ruhusa juu ya rasilimali maalum kwa kuonyesha kama ifuatavyo:
|
||||
```bash
|
||||
Get-AzRoleAssignment -Scope /subscriptions/<subscription-id>/resourceGroups/Resource_Group_1/providers/Microsoft.RecoveryServices/vaults/vault-m3ww8ut4
|
||||
```
|
||||
Ni pia inawezekana kupata taarifa hii ukiendesha:
|
||||
Inawezekana pia kupata taarifa hii ukiendesha:
|
||||
```bash
|
||||
az rest --method GET --uri "https://management.azure.com/<Scope>/providers/Microsoft.Authorization/roleAssignments?api-version=2020-08-01-preview" | jq ".value"
|
||||
az rest --method GET --uri "https://management.azure.com/<Scope>/providers/Microsoft.Authorization/roleAssignments?api-version=2022-04-01" | jq ".value"
|
||||
```
|
||||
Samahani, naweza kusaidia vipi?
|
||||
kama katika:
|
||||
```bash
|
||||
az rest --method GET --uri "https://management.azure.com//subscriptions/<subscription-id>/resourceGroups/Resource_Group_1/providers/Microsoft.KeyVault/vaults/vault-m3ww8ut4/providers/Microsoft.Authorization/roleAssignments?api-version=2020-08-01-preview" | jq ".value"
|
||||
az rest --method GET --uri "https://management.azure.com//subscriptions/<subscription-id>/resourceGroups/Resource_Group_1/providers/Microsoft.KeyVault/vaults/vault-m3ww8ut4/providers/Microsoft.Authorization/roleAssignments?api-version=2022-04-01" | jq ".value"
|
||||
```
|
||||
Njia nyingine ni kupata majukumu yaliyoambatanishwa na wewe katika azure kwa:
|
||||
- Chaguo jingine ni **kupata majukumu yaliyoambatanishwa nawe katika azure**. Hii pia inahitaji ruhusa **`Microsoft.Authorization/roleAssignments/read`**:
|
||||
```bash
|
||||
az role assignment list --assignee "<email>" --all --output table
|
||||
```
|
||||
Au kukimbia yafuatayo (Ikiwa matokeo ni tupu huenda ni kwa sababu huna ruhusa ya kuyapata):
|
||||
Au kukimbia yafuatayo (Ikiwa matokeo ni tupu inaweza kuwa kwa sababu huna ruhusa ya kuyapata):
|
||||
```bash
|
||||
az rest --method GET --uri 'https://management.azure.com/subscriptions/<subscription-id>/providers/Microsoft.Authorization/roleAssignments?api-version=2022-04-01&$filter=principalId eq '<user-id>'
|
||||
```
|
||||
3. **Pata ruhusa za kina za majukumu yaliyoambatanishwa na wewe**:
|
||||
- **Pata ruhusa za kina za majukumu yaliyoambatanishwa na wewe**:
|
||||
|
||||
Kisha, ili kupata ruhusa za kina unaweza kukimbia **`(Get-AzRoleDefinition -Id "<RoleDefinitionId>").Actions`**.
|
||||
|
||||
Au piga simu kwa API moja kwa moja na
|
||||
```bash
|
||||
az rest --method GET --uri "https://management.azure.com//subscriptions/<subscription-id>/providers/Microsoft.Authorization/roleDefinitions/<RoleDefinitionId>?api-version=2020-08-01-preview" | jq ".properties"
|
||||
az rest --method GET --uri "https://management.azure.com//subscriptions/<subscription-id>/providers/Microsoft.Authorization/roleDefinitions/<RoleDefinitionId>?api-version=2022-04-01" | jq ".properties"
|
||||
```
|
||||
</details>
|
||||
|
||||
Katika sehemu ifuatayo unaweza kupata **habari kuhusu huduma za kawaida za Azure na jinsi ya kuzipata**:
|
||||
|
||||
{{#ref}}
|
||||
az-services/
|
||||
{{#endref}}
|
||||
|
||||
### Kuongeza Mamlaka, Baada ya Utekelezaji & Kudumu
|
||||
### Kuinua Mamlaka, Baada ya Utekelezaji & Kudumu
|
||||
|
||||
Mara tu unavyojua jinsi mazingira ya Azure yalivyojengwa na ni huduma zipi zinatumika, unaweza kuanza kutafuta njia za **kuongeza mamlaka, kuhamasisha kwa upande, kufanya mashambulizi mengine baada ya utekelezaji na kudumisha**.
|
||||
Mara tu unavyojua jinsi mazingira ya Azure yalivyojengwa na ni huduma zipi zinatumika, unaweza kuanza kutafuta njia za **kuinua mamlaka, kuhamasisha kwa upande, kufanya mashambulizi mengine baada ya utekelezaji na kudumisha uwepo**.
|
||||
|
||||
Katika sehemu ifuatayo unaweza kupata habari kuhusu jinsi ya kuongeza mamlaka katika huduma za kawaida za Azure:
|
||||
Katika sehemu ifuatayo unaweza kupata habari kuhusu jinsi ya kuinua mamlaka katika huduma za kawaida za Azure:
|
||||
|
||||
{{#ref}}
|
||||
az-privilege-escalation/
|
||||
{{#endref}}
|
||||
|
||||
Katika ifuatayo unaweza kupata habari kuhusu jinsi ya kufanya mashambulizi baada ya utekelezaji katika huduma za kawaida za Azure:
|
||||
Katika sehemu ifuatayo unaweza kupata habari kuhusu jinsi ya kufanya mashambulizi baada ya utekelezaji katika huduma za kawaida za Azure:
|
||||
|
||||
{{#ref}}
|
||||
az-post-exploitation/
|
||||
{{#endref}}
|
||||
|
||||
Katika ifuatayo unaweza kupata habari kuhusu jinsi ya kudumisha katika huduma za kawaida za Azure:
|
||||
Katika sehemu ifuatayo unaweza kupata habari kuhusu jinsi ya kudumisha uwepo katika huduma za kawaida za Azure:
|
||||
|
||||
{{#ref}}
|
||||
az-persistence/
|
||||
|
||||
Reference in New Issue
Block a user