diff --git a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-token-leakage.md b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-token-leakage.md index c514d7a7c..3fae9a144 100644 --- a/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-token-leakage.md +++ b/src/pentesting-cloud/aws-security/aws-post-exploitation/aws-codebuild-post-exploitation/aws-codebuild-token-leakage.md @@ -185,6 +185,23 @@ aws codebuild start-build --project-name > [!WARNING] > Now an attacker will be able to use the token from his machine, list all the privileges it has and (ab)use easier than using the CodeBuild service directly. +## Webhook filter ACTOR_ID regex allowlist bypass (PR-triggered privileged builds) + +Misconfigured CodeBuild GitHub webhooks that use unanchored `ACTOR_ID` regexes let *untrusted* PRs start privileged builds. If the allowlist is like `123456|7890123` without `^`/`$`, any ID containing one of those substrings matches. Because GitHub user IDs are sequential, an attacker can race to register an “eclipsing” ID (a superstring of a trusted ID) and trigger the build. + +**Exploit path** + +1. Find public CodeBuild projects exposing webhook filters and extract an unanchored `ACTOR_ID` allowlist. +2. Obtain an eclipsing GitHub ID: + - Sample the global ID counter by creating/deleting GitHub orgs (org IDs share the pool). + - Pre-stage many GitHub App manifest creations and fire the confirmation URLs when the counter is within ~100 IDs of the target to burst-register a bot ID containing the trusted substring. +3. Open a PR from the eclipsing account; the regex matches the substring and the privileged build runs. +4. Use build RCE (e.g., dependency install hooks) to dump process memory handling the GitHub credential and recover the PAT/OAuth token. +5. With the token’s `repo` scope, invite your account as collaborator/admin and push/approve malicious commits or exfiltrate secrets. + +## References +- [Wiz: CodeBreach – AWS CodeBuild ACTOR_ID regex bypass and token theft](https://www.wiz.io/blog/wiz-research-codebreach-vulnerability-aws-codebuild) + {{#include ../../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/azure-security/az-services/az-storage.md b/src/pentesting-cloud/azure-security/az-services/az-storage.md index d922e1355..82581615d 100644 --- a/src/pentesting-cloud/azure-security/az-services/az-storage.md +++ b/src/pentesting-cloud/azure-security/az-services/az-storage.md @@ -65,7 +65,24 @@ If "Allow Blob public access" is **enabled** (disabled by default), when creatin
-#### Auditing anonymous blob exposure +### Static website (`$web`) exposure & leaked secrets + +- **Static websites** are served from the special `$web` container over a region-specific endpoint such as `https://.z13.web.core.windows.net/`. +- The `$web` container may report `publicAccess: null` via the blob API, but files are still reachable through the static site endpoint, so dropping config/IaC artifacts there can leak secrets. +- Quick audit workflow: + +```bash +# Identify storage accounts with static website hosting enabled +az storage blob service-properties show --account-name --auth-mode login +# Enumerate containers (including $web) and their public flags +az storage container list --account-name --auth-mode login +# List files served by the static site even when publicAccess is null +az storage blob list --container-name '$web' --account-name --auth-mode login +# Pull suspicious files directly (e.g., IaC tfvars containing secrets/SAS) +az storage blob download -c '$web' --name iac/terraform.tfvars --file /dev/stdout --account-name --auth-mode login +``` + +### Auditing anonymous blob exposure - **Locate storage accounts** that can expose data: `az storage account list | jq -r '.[] | select(.properties.allowBlobPublicAccess==true) | .name'`. If `allowBlobPublicAccess` is `false` you cannot turn containers public. - **Inspect risky accounts** to confirm the flag and other weak settings: `az storage account show --name --query '{allow:properties.allowBlobPublicAccess, minTls:properties.minimumTlsVersion}'`. @@ -467,6 +484,7 @@ az-file-shares.md - [https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction) - [https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview](https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview) - [https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support](https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support) +- [Holiday Hack Challenge 2025 – Spare Key (Azure static website SAS leak)](https://0xdf.gitlab.io/holidayhack2025/act1/spare-key) - [Holiday Hack Challenge 2025: Blob Storage (Storage Secrets)](https://0xdf.gitlab.io/holidayhack2025/act1/blob-storage) - [https://learn.microsoft.com/en-us/cli/azure/storage/account](https://learn.microsoft.com/en-us/cli/azure/storage/account) - [https://learn.microsoft.com/en-us/cli/azure/storage/container](https://learn.microsoft.com/en-us/cli/azure/storage/container)