mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2025-12-22 23:26:41 -08:00
Recreating repository history for branch master
This commit is contained in:
Carlos Polop
@@ -0,0 +1,2 @@
|
||||
# Az - Post Exploitation
|
||||
|
||||
@@ -0,0 +1,71 @@
|
||||
# Az - Blob Storage Post Exploitation
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Storage Privesc
|
||||
|
||||
For more information about storage check:
|
||||
|
||||
{% content-ref url="../az-services/az-storage.md" %}
|
||||
[az-storage.md](../az-services/az-storage.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
### Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read
|
||||
|
||||
A principal with this permission will be able to **list** the blobs (files) inside a container and **download** the files which might contain **sensitive information**.
|
||||
|
||||
```bash
|
||||
# e.g. Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read
|
||||
az storage blob list \
|
||||
--account-name <acc-name> \
|
||||
--container-name <container-name> --auth-mode login
|
||||
|
||||
az storage blob download \
|
||||
--account-name <acc-name> \
|
||||
--container-name <container-name> \
|
||||
-n file.txt --auth-mode login
|
||||
```
|
||||
|
||||
### Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write
|
||||
|
||||
A principal with this permission will be able to **write and overwrite files in containers** which might allow him to cause some damage or even escalate privileges (e.g. overwrite some code stored in a blob):
|
||||
|
||||
```bash
|
||||
# e.g. Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write
|
||||
az storage blob upload \
|
||||
--account-name <acc-name> \
|
||||
--container-name <container-name> \
|
||||
--file /tmp/up.txt --auth-mode login --overwrite
|
||||
```
|
||||
|
||||
### \*/delete
|
||||
|
||||
This would allow to delete objects inside the storage account which might **interrupt some services** or make the client **lose valuable information**.
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
@@ -0,0 +1,74 @@
|
||||
# Az - File Share Post Exploitation
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## File Share Privesc
|
||||
|
||||
For more information about file shares check:
|
||||
|
||||
{% content-ref url="../az-services/az-file-shares.md" %}
|
||||
[az-file-shares.md](../az-services/az-file-shares.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
### Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read
|
||||
|
||||
A principal with this permission will be able to **list** the files inside a file share and **download** the files which might contain **sensitive information**.
|
||||
|
||||
```bash
|
||||
# List files inside an azure file share
|
||||
az storage file list \
|
||||
--account-name <name> \
|
||||
--share-name <share-name> \
|
||||
--auth-mode login --enable-file-backup-request-intent
|
||||
|
||||
# Download an specific file
|
||||
az storage file download \
|
||||
--account-name <name> \
|
||||
--share-name <share-name> \
|
||||
--path <filename-to-download> \
|
||||
--dest /path/to/down \
|
||||
--auth-mode login --enable-file-backup-request-intent
|
||||
```
|
||||
|
||||
### Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write, Microsoft.Storage/storageAccounts/fileServices/writeFileBackupSemantics/action
|
||||
|
||||
A principal with this permission will be able to **write and overwrite files in file shares** which might allow him to cause some damage or even escalate privileges (e.g. overwrite some code stored in a file share):
|
||||
|
||||
```bash
|
||||
az storage blob upload \
|
||||
--account-name <acc-name> \
|
||||
--container-name <container-name> \
|
||||
--file /tmp/up.txt --auth-mode login --overwrite
|
||||
```
|
||||
|
||||
### \*/delete
|
||||
|
||||
This would allow to delete file inside the shared filesystem which might **interrupt some services** or make the client **lose valuable information**.
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
@@ -0,0 +1,147 @@
|
||||
# Az - Key Vault Post Exploitation
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Azure Key Vault
|
||||
|
||||
For more information about this service check:
|
||||
|
||||
{% content-ref url="../az-services/keyvault.md" %}
|
||||
[keyvault.md](../az-services/keyvault.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
### Microsoft.KeyVault/vaults/secrets/getSecret/action
|
||||
|
||||
This permission will allow a principal to read the secret value of secrets:
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az keyvault secret show --vault-name <vault name> --name <secret name>
|
||||
|
||||
# Get old version secret value
|
||||
az keyvault secret show --id https://<KeyVaultName>.vault.azure.net/secrets/<KeyVaultName>/<idOldVersion>
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
### **Microsoft.KeyVault/vaults/certificates/purge/action**
|
||||
|
||||
This permission allows a principal to permanently delete a certificate from the vault.
|
||||
|
||||
```bash
|
||||
az keyvault certificate purge --vault-name <vault name> --name <certificate name>
|
||||
```
|
||||
|
||||
### **Microsoft.KeyVault/vaults/keys/encrypt/action**
|
||||
|
||||
This permission allows a principal to encrypt data using a key stored in the vault.
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az keyvault key encrypt --vault-name <vault name> --name <key name> --algorithm <algorithm> --value <value>
|
||||
|
||||
# Example
|
||||
echo "HackTricks" | base64 # SGFja1RyaWNrcwo=
|
||||
az keyvault key encrypt --vault-name testing-1231234 --name testing --algorithm RSA-OAEP-256 --value SGFja1RyaWNrcwo=
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
### **Microsoft.KeyVault/vaults/keys/decrypt/action**
|
||||
|
||||
This permission allows a principal to decrypt data using a key stored in the vault.
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az keyvault key decrypt --vault-name <vault name> --name <key name> --algorithm <algorithm> --value <value>
|
||||
|
||||
# Example
|
||||
az keyvault key decrypt --vault-name testing-1231234 --name testing --algorithm RSA-OAEP-256 --value "ISZ+7dNcDJXLPR5MkdjNvGbtYK3a6Rg0ph/+3g1IoUrCwXnF791xSF0O4rcdVyyBnKRu0cbucqQ/+0fk2QyAZP/aWo/gaxUH55pubS8Zjyw/tBhC5BRJiCtFX4tzUtgTjg8lv3S4SXpYUPxev9t/9UwUixUlJoqu0BgQoXQhyhP7PfgAGsxayyqxQ8EMdkx9DIR/t9jSjv+6q8GW9NFQjOh70FCjEOpYKy9pEGdLtPTrirp3fZXgkYfIIV77TXuHHdR9Z9GG/6ge7xc9XT6X9ciE7nIXNMQGGVCcu3JAn9BZolb3uL7PBCEq+k2rH4tY0jwkxinM45tg38Re2D6CEA==" # This is the result from the previous encryption
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
### **Microsoft.KeyVault/vaults/keys/purge/action**
|
||||
|
||||
This permission allows a principal to permanently delete a key from the vault.
|
||||
|
||||
```bash
|
||||
az keyvault key purge --vault-name <vault name> --name <key name>
|
||||
```
|
||||
|
||||
### **Microsoft.KeyVault/vaults/secrets/purge/action**
|
||||
|
||||
This permission allows a principal to permanently delete a secret from the vault.
|
||||
|
||||
```bash
|
||||
az keyvault secret purge --vault-name <vault name> --name <secret name>
|
||||
```
|
||||
|
||||
### **Microsoft.KeyVault/vaults/secrets/setSecret/action**
|
||||
|
||||
This permission allows a principal to create or update a secret in the vault.
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az keyvault secret set --vault-name <vault name> --name <secret name> --value <secret value>
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
### **Microsoft.KeyVault/vaults/certificates/delete**
|
||||
|
||||
This permission allows a principal to delete a certificate from the vault. The certificate is moved to the "soft-delete" state, where it can be recovered unless purged.
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az keyvault certificate delete --vault-name <vault name> --name <certificate name>
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
### **Microsoft.KeyVault/vaults/keys/delete**
|
||||
|
||||
This permission allows a principal to delete a key from the vault. The key is moved to the "soft-delete" state, where it can be recovered unless purged.
|
||||
|
||||
```bash
|
||||
az keyvault key delete --vault-name <vault name> --name <key name>
|
||||
```
|
||||
|
||||
### **Microsoft.KeyVault/vaults/secrets/delete**
|
||||
|
||||
This permission allows a principal to delete a secret from the vault. The secret is moved to the "soft-delete" state, where it can be recovered unless purged.
|
||||
|
||||
```bash
|
||||
az keyvault secret delete --vault-name <vault name> --name <secret name>
|
||||
```
|
||||
|
||||
### Microsoft.KeyVault/vaults/secrets/restore/action
|
||||
|
||||
This permission allows a principal to restore a secret from a backup.
|
||||
|
||||
```bash
|
||||
az keyvault secret restore --vault-name <vault-name> --file <backup-file-path>
|
||||
```
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
@@ -0,0 +1,129 @@
|
||||
# Az - Queue Storage Post Exploitation
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Queue
|
||||
|
||||
For more information check:
|
||||
|
||||
{% content-ref url="../az-services/az-queue-enum.md" %}
|
||||
[az-queue-enum.md](../az-services/az-queue-enum.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
### DataActions: `Microsoft.Storage/storageAccounts/queueServices/queues/messages/read`
|
||||
|
||||
An attacker with this permission can peek messages from an Azure Storage Queue. This allows the attacker to view the content of messages without marking them as processed or altering their state. This could lead to unauthorized access to sensitive information, enabling data exfiltration or gathering intelligence for further attacks.
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az storage message peek --queue-name <queue_name> --account-name <storage_account>
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
**Potential Impact**: Unauthorized access to the queue, message exposure, or queue manipulation by unauthorized users or services.
|
||||
|
||||
### DataActions: `Microsoft.Storage/storageAccounts/queueServices/queues/messages/process/action`
|
||||
|
||||
With this permission, an attacker can retrieve and process messages from an Azure Storage Queue. This means they can read the message content and mark it as processed, effectively hiding it from legitimate systems. This could lead to sensitive data being exposed, disruptions in how messages are handled, or even stopping important workflows by making messages unavailable to their intended users.
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az storage message get --queue-name <queue_name> --account-name <storage_account>
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
### DataActions: `Microsoft.Storage/storageAccounts/queueServices/queues/messages/add/action`
|
||||
|
||||
With this permission, an attacker can add new messages to an Azure Storage Queue. This allows them to inject malicious or unauthorized data into the queue, potentially triggering unintended actions or disrupting downstream services that process the messages.
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az storage message put --queue-name <queue-name> --content "Injected malicious message" --account-name <storage-account>
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
### DataActions: `Microsoft.Storage/storageAccounts/queueServices/queues/messages/write`
|
||||
|
||||
This permission allows an attacker to add new messages or update existing ones in an Azure Storage Queue. By using this, they could insert harmful content or alter existing messages, potentially misleading applications or causing undesired behaviors in systems that rely on the queue.
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az storage message put --queue-name <queue-name> --content "Injected malicious message" --account-name <storage-account>
|
||||
|
||||
#Update the message
|
||||
az storage message update --queue-name <queue-name> \
|
||||
--id <message-id> \
|
||||
--pop-receipt <pop-receipt> \
|
||||
--content "Updated message content" \
|
||||
--visibility-timeout <timeout-in-seconds> \
|
||||
--account-name <storage-account>
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
### Actions: `Microsoft.Storage/storageAccounts/queueServices/queues/delete`
|
||||
|
||||
This permission allows an attacker to delete queues within the storage account. By leveraging this capability, an attacker can permanently remove queues and all their associated messages, causing significant disruption to workflows and resulting in critical data loss for applications that rely on the affected queues. This action can also be used to sabotage services by removing essential components of the system.
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az storage queue delete --name <queue-name> --account-name <storage-account>
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
### DataActions: `Microsoft.Storage/storageAccounts/queueServices/queues/messages/delete`
|
||||
|
||||
With this permission, an attacker can clear all messages from an Azure Storage Queue. This action removes all messages, disrupting workflows and causing data loss for systems dependent on the queue.
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az storage message clear --queue-name <queue-name> --account-name <storage-account>
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
### Actions: `Microsoft.Storage/storageAccounts/queueServices/queues/write`
|
||||
|
||||
This permission allows an attacker to create or modify queues and their properties within the storage account. It can be used to create unauthorized queues, modify metadata, or change access control lists (ACLs) to grant or restrict access. This capability could disrupt workflows, inject malicious data, exfiltrate sensitive information, or manipulate queue settings to enable further attacks.
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az storage queue create --name <new-queue-name> --account-name <storage-account>
|
||||
|
||||
az storage queue metadata update --name <queue-name> --metadata key1=value1 key2=value2 --account-name <storage-account>
|
||||
|
||||
az storage queue policy set --name <queue-name> --permissions rwd --expiry 2024-12-31T23:59:59Z --account-name <storage-account>
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
## References
|
||||
|
||||
* https://learn.microsoft.com/en-us/azure/storage/queues/storage-powershell-how-to-use-queues
|
||||
* https://learn.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api
|
||||
* https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-attributes
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
@@ -0,0 +1,140 @@
|
||||
# Az - Service Bus Post Exploitation
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="../../.gitbook/assets/image (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../.gitbook/assets/image (1) (1).png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../../.gitbook/assets/image (2).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../.gitbook/assets/image (2).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Service Bus
|
||||
|
||||
For more information check:
|
||||
|
||||
{% content-ref url="../az-services/az-servicebus-enum.md" %}
|
||||
[az-servicebus-enum.md](../az-services/az-servicebus-enum.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
### Actions: `Microsoft.ServiceBus/namespaces/Delete`
|
||||
|
||||
An attacker with this permission can delete an entire Azure Service Bus namespace. This action removes the namespace and all associated resources, including queues, topics, subscriptions, and their messages, causing widespread disruption and permanent data loss across all dependent systems and workflows.
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az servicebus namespace delete --resource-group <ResourceGroupName> --name <NamespaceName>
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
### Actions: `Microsoft.ServiceBus/namespaces/topics/Delete`
|
||||
|
||||
An attacker with this permission can delete an Azure Service Bus topic. This action removes the topic and all its associated subscriptions and messages, potentially causing loss of critical data and disrupting systems and workflows relying on the topic.
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az servicebus topic delete --resource-group <ResourceGroupName> --namespace-name <NamespaceName> --name <TopicName>
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
### Actions: `Microsoft.ServiceBus/namespaces/queues/Delete`
|
||||
|
||||
An attacker with this permission can delete an Azure Service Bus queue. This action removes the queue and all the messages within it, potentially causing loss of critical data and disrupting systems and workflows dependent on the queue.
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az servicebus queue delete --resource-group <ResourceGroupName> --namespace-name <NamespaceName> --name <QueueName>
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
### Actions: `Microsoft.ServiceBus/namespaces/topics/subscriptions/Delete`
|
||||
|
||||
An attacker with this permission can delete an Azure Service Bus subscription. This action removes the subscription and all its associated messages, potentially disrupting workflows, data processing, and system operations relying on the subscription.
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az servicebus topic subscription delete --resource-group <ResourceGroupName> --namespace-name <NamespaceName> --topic-name <TopicName> --name <SubscriptionName>
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
### Actions: `Microsoft.ServiceBus/namespaces/write` & `Microsoft.ServiceBus/namespaces/read`
|
||||
|
||||
An attacker with permissions to create or modify Azure Service Bus namespaces can exploit this to disrupt operations, deploy unauthorized resources, or expose sensitive data. They can alter critical configurations such as enabling public network access, downgrading encryption settings, or changing SKUs to degrade performance or increase costs. Additionally, they could disable local authentication, manipulate replica locations, or adjust TLS versions to weaken security controls, making namespace misconfiguration a significant post-exploitation risk.
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az servicebus namespace create --resource-group <ResourceGroupName> --name <NamespaceName> --location <Location>
|
||||
az servicebus namespace update --resource-group <ResourceGroupName> --name <NamespaceName> --tags <Key=Value>
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
|
||||
### Actions: `Microsoft.ServiceBus/namespaces/queues/write` (`Microsoft.ServiceBus/namespaces/queues/read`)
|
||||
|
||||
An attacker with permissions to create or modify Azure Service Bus queues (to modiffy the queue you will also need the Action:`Microsoft.ServiceBus/namespaces/queues/read`) can exploit this to intercept data, disrupt workflows, or enable unauthorized access. They can alter critical configurations such as forwarding messages to malicious endpoints, adjusting message TTL to retain or delete data improperly, or enabling dead-lettering to interfere with error handling. Additionally, they could manipulate queue sizes, lock durations, or statuses to disrupt service functionality or evade detection, making this a significant post-exploitation risk.
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az servicebus queue create --resource-group <ResourceGroupName> --namespace-name <NamespaceName> --name <QueueName>
|
||||
az servicebus queue update --resource-group <ResourceGroupName> --namespace-name <NamespaceName> --name <QueueName>
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
### Actions: `Microsoft.ServiceBus/namespaces/topics/write` (`Microsoft.ServiceBus/namespaces/topics/read`)
|
||||
|
||||
An attacker with permissions to create or modify topics (to modiffy the topic you will also need the Action:`Microsoft.ServiceBus/namespaces/topics/read`) within an Azure Service Bus namespace can exploit this to disrupt message workflows, expose sensitive data, or enable unauthorized actions. Using commands like az servicebus topic update, they can manipulate configurations such as enabling partitioning for scalability misuse, altering TTL settings to retain or discard messages improperly, or disabling duplicate detection to bypass controls. Additionally, they could adjust topic size limits, change status to disrupt availability, or configure express topics to temporarily store intercepted messages, making topic management a critical focus for post-exploitation mitigation.
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az servicebus topic create --resource-group <ResourceGroupName> --namespace-name <NamespaceName> --name <TopicName>
|
||||
az servicebus topic update --resource-group <ResourceGroupName> --namespace-name <NamespaceName> --name <TopicName>
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
### Actions: `Microsoft.ServiceBus/namespaces/topics/subscriptions/write` (`Microsoft.ServiceBus/namespaces/topics/subscriptions/read`)
|
||||
|
||||
An attacker with permissions to create or modify subscriptions (to modiffy the subscription you will also need the Action: `Microsoft.ServiceBus/namespaces/topics/subscriptions/read`) within an Azure Service Bus topic can exploit this to intercept, reroute, or disrupt message workflows. Using commands like az servicebus topic subscription update, they can manipulate configurations such as enabling dead lettering to divert messages, forwarding messages to unauthorized endpoints, or modifying TTL and lock duration to retain or interfere with message delivery. Additionally, they can alter status or max delivery count settings to disrupt operations or evade detection, making subscription control a critical aspect of post-exploitation scenarios.
|
||||
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az servicebus topic subscription create --resource-group <ResourceGroupName> --namespace-name <NamespaceName> --topic-name <TopicName> --name <SubscriptionName>
|
||||
az servicebus topic subscription update --resource-group <ResourceGroupName> --namespace-name <NamespaceName> --topic-name <TopicName> --name <SubscriptionName>
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
|
||||
### Actions: `AuthorizationRules` Send & Recive Messages
|
||||
|
||||
Take a look here:
|
||||
|
||||
{% content-ref url="../az-services/az-queue-privesc.md" %}
|
||||
[az-queue-privesc.md](../az-services/az-queue-privesc.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
## References
|
||||
|
||||
* https://learn.microsoft.com/en-us/azure/storage/queues/storage-powershell-how-to-use-queues
|
||||
* https://learn.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api
|
||||
* https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-attributes
|
||||
* https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-python-how-to-use-topics-subscriptions?tabs=passwordless
|
||||
* https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/integration#microsoftservicebus
|
||||
* https://learn.microsoft.com/en-us/cli/azure/servicebus/namespace?view=azure-cli-latest
|
||||
* https://learn.microsoft.com/en-us/cli/azure/servicebus/queue?view=azure-cli-latest
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
@@ -0,0 +1,90 @@
|
||||
# Az - Table Storage Post Exploitation
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Table Storage Privesc
|
||||
|
||||
For more information about table storage check:
|
||||
|
||||
{% content-ref url="../az-services/az-table-storage.md" %}
|
||||
[az-table-storage.md](../az-services/az-table-storage.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
### Microsoft.Storage/storageAccounts/tableServices/tables/entities/read
|
||||
|
||||
A principal with this permission will be able to **list** the tables inside a table storage and **read the info** which might contain **sensitive information**.
|
||||
|
||||
```bash
|
||||
# List tables
|
||||
az storage table list --auth-mode login --account-name <name>
|
||||
|
||||
# Read table (top 10)
|
||||
az storage entity query \
|
||||
--account-name <name> \
|
||||
--table-name <t-name> \
|
||||
--auth-mode login \
|
||||
--top 10
|
||||
```
|
||||
|
||||
### Microsoft.Storage/storageAccounts/tableServices/tables/entities/write | Microsoft.Storage/storageAccounts/tableServices/tables/entities/add/action | Microsoft.Storage/storageAccounts/tableServices/tables/entities/update/action
|
||||
|
||||
A principal with this permission will be able to **write and overwrite entries in tables** which might allow him to cause some damage or even escalate privileges (e.g. overwrite some trusted data that could abuse some injection vulnerability in the app using it).
|
||||
|
||||
* The permission `Microsoft.Storage/storageAccounts/tableServices/tables/entities/write` allows all the actions.
|
||||
* The permission `Microsoft.Storage/storageAccounts/tableServices/tables/entities/add/action` allows to **add** entries
|
||||
* The permission `Microsoft.Storage/storageAccounts/tableServices/tables/entities/update/action` allows to **update** existing entries
|
||||
|
||||
```bash
|
||||
# Add
|
||||
az storage entity insert \
|
||||
--account-name <acc-name> \
|
||||
--table-name <t-name> \
|
||||
--auth-mode login \
|
||||
--entity PartitionKey=HR RowKey=12345 Name="John Doe" Age=30 Title="Manager"
|
||||
|
||||
# Replace
|
||||
az storage entity replace \
|
||||
--account-name <acc-name> \
|
||||
--table-name <t-name> \
|
||||
--auth-mode login \
|
||||
--entity PartitionKey=HR RowKey=12345 Name="John Doe" Age=30 Title="Manager"
|
||||
|
||||
# Update
|
||||
az storage entity merge \
|
||||
--account-name <acc-name> \
|
||||
--table-name <t-name> \
|
||||
--auth-mode login \
|
||||
--entity PartitionKey=HR RowKey=12345 Name="John Doe" Age=30 Title="Manager"
|
||||
```
|
||||
|
||||
### \*/delete
|
||||
|
||||
This would allow to delete file inside the shared filesystem which might **interrupt some services** or make the client **lose valuable information**.
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
@@ -0,0 +1,210 @@
|
||||
# Az - VMs & Network Post Exploitation
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## VMs & Network
|
||||
|
||||
For more info about Azure VMs and networking check the following page:
|
||||
|
||||
{% content-ref url="../az-services/vms/" %}
|
||||
[vms](../az-services/vms/)
|
||||
{% endcontent-ref %}
|
||||
|
||||
### VM Application Pivoting
|
||||
|
||||
VM applications can be shared with other subscriptions and tenants. If an application is being shared it's probably because it's being used. So if the attacker manages to **compromise the application and uploads a backdoored** version it might be possible that it will be **executed in another tenant or subscription**.
|
||||
|
||||
### Sensitive information in images
|
||||
|
||||
It might be possible to find **sensitive information inside images** taken from VMs in the past.
|
||||
|
||||
1. **List images** from galleries
|
||||
|
||||
```bash
|
||||
# Get galleries
|
||||
az sig list -o table
|
||||
|
||||
# List images inside gallery
|
||||
az sig image-definition list \
|
||||
--resource-group <RESOURCE_GROUP> \
|
||||
--gallery-name <GALLERY_NAME> \
|
||||
-o table
|
||||
|
||||
# Get images versions
|
||||
az sig image-version list \
|
||||
--resource-group <RESOURCE_GROUP> \
|
||||
--gallery-name <GALLERY_NAME> \
|
||||
--gallery-image-definition <IMAGE_DEFINITION> \
|
||||
-o table
|
||||
```
|
||||
|
||||
2. **List custom images**
|
||||
|
||||
```bash
|
||||
az image list -o table
|
||||
```
|
||||
|
||||
3. **Create VM from image ID** and search for sensitive info inside of it
|
||||
|
||||
```bash
|
||||
# Create VM from image
|
||||
az vm create \
|
||||
--resource-group <RESOURCE_GROUP> \
|
||||
--name <VM_NAME> \
|
||||
--image /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Compute/galleries/<GALLERY_NAME>/images/<IMAGE_DEFINITION>/versions/<IMAGE_VERSION> \
|
||||
--admin-username <ADMIN_USERNAME> \
|
||||
--generate-ssh-keys
|
||||
```
|
||||
|
||||
### Sensitive information in restore points
|
||||
|
||||
It might be possible to find **sensitive information inside restore points**.
|
||||
|
||||
1. **List restore points**
|
||||
|
||||
```bash
|
||||
az restore-point list \
|
||||
--resource-group <RESOURCE_GROUP> \
|
||||
--restore-point-collection-name <COLLECTION_NAME> \
|
||||
-o table
|
||||
```
|
||||
|
||||
2. **Create a disk** from a restore point
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az disk create \
|
||||
--resource-group <RESOURCE_GROUP> \
|
||||
--name <NEW_DISK_NAME> \
|
||||
--source /subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP>/providers/Microsoft.Compute/restorePointCollections/<COLLECTION_NAME>/restorePoints/<RESTORE_POINT_NAME>
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
3. **Attach the disk to a VM** (the attacker needs to have compromised a VM inside the account already)
|
||||
|
||||
```bash
|
||||
az vm disk attach \
|
||||
--resource-group <RESOURCE_GROUP> \
|
||||
--vm-name <VM_NAME> \
|
||||
--name <DISK_NAME>
|
||||
```
|
||||
|
||||
4. **Mount** the disk and **search for sensitive info**
|
||||
|
||||
{% tabs %}
|
||||
{% tab title="Linux" %}
|
||||
```bash
|
||||
# List all available disks
|
||||
sudo fdisk -l
|
||||
|
||||
# Check disk format
|
||||
sudo file -s /dev/sdX
|
||||
|
||||
# Mount it
|
||||
sudo mkdir /mnt/mydisk
|
||||
sudo mount /dev/sdX1 /mnt/mydisk
|
||||
```
|
||||
{% endtab %}
|
||||
|
||||
{% tab title="Windows" %}
|
||||
#### **1. Open Disk Management**
|
||||
|
||||
1. Right-click **Start** and select **Disk Management**.
|
||||
2. The attached disk should appear as **Offline** or **Unallocated**.
|
||||
|
||||
#### **2. Bring the Disk Online**
|
||||
|
||||
1. Locate the disk in the bottom pane.
|
||||
2. Right-click the disk (e.g., **Disk 1**) and select **Online**.
|
||||
|
||||
#### **3. Initialize the Disk**
|
||||
|
||||
1. If the disk is not initialized, right-click and select **Initialize Disk**.
|
||||
2. Choose the partition style:
|
||||
* **MBR** (Master Boot Record) or **GPT** (GUID Partition Table). GPT is recommended for modern systems.
|
||||
|
||||
#### **4. Create a New Volume**
|
||||
|
||||
1. Right-click the unallocated space on the disk and select **New Simple Volume**.
|
||||
2. Follow the wizard to:
|
||||
* Assign a drive letter (e.g., `D:`).
|
||||
* Format the disk (choose NTFS for most cases).
|
||||
{% endtab %}
|
||||
{% endtabs %}
|
||||
|
||||
### Sensitive information in disks & snapshots
|
||||
|
||||
It might be possible to find **sensitive information inside disks or even old disk's snapshots**.
|
||||
|
||||
1. **List snapshots**
|
||||
|
||||
```bash
|
||||
az snapshot list \
|
||||
--resource-group <RESOURCE_GROUP> \
|
||||
-o table
|
||||
```
|
||||
|
||||
2. **Create disk from snapshot** (if needed)
|
||||
|
||||
```bash
|
||||
az disk create \
|
||||
--resource-group <RESOURCE_GROUP> \
|
||||
--name <DISK_NAME> \
|
||||
--source <SNAPSHOT_ID> \
|
||||
--size-gb <DISK_SIZE>
|
||||
```
|
||||
|
||||
3. **Attach and mount the disk** to a VM and search for sensitive information (check the previous section to see how to do this)
|
||||
|
||||
### Sensitive information in VM Extensions & VM Applications
|
||||
|
||||
It might be possible to find **sensitive information inside VM extensions and VM applications**.
|
||||
|
||||
1. **List all VM apps**
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
## List all VM applications inside a gallery
|
||||
az sig gallery-application list --gallery-name <gallery-name> --resource-group <res-group> --output table
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
2. Install the extension in a VM and **search for sensitive info**
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
az vm application set \
|
||||
--resource-group <rsc-group> \
|
||||
--name <vm-name> \
|
||||
--app-version-ids /subscriptions/9291ff6e-6afb-430e-82a4-6f04b2d05c7f/resourceGroups/Resource_Group_1/providers/Microsoft.Compute/galleries/myGallery/applications/myReverseShellApp/versions/1.0.2 \
|
||||
--treat-deployment-as-failure true
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
Reference in New Issue
Block a user