gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-07-28 22:51:09 -07:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['', 'src/pentesting-cloud/azure-security/az-services/az-stor

Browse Source
This commit is contained in:
Translator
2026-07-09 16:57:46 +00:00
parent 106bf7c338
commit 8064d7a4bd
1 changed files with 69 additions and 68 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pentesting-cloud/azure-security/az-services/az-storage.md
+69 -68
View File
@@ -4,52 +4,52 @@
## Basiese Inligting
Azure Storage Accounts is fundamentele services in Microsoft Azure wat skaalbare, veilige en hoogs beskikbare cloud **storage for various data types** bied, insluitend blobs (binary large objects), files, queues, en tables. Hulle dien as containers wat hierdie verskillende storage services saam groepeer onder 'n enkele namespace vir maklike bestuur.
Azure Storage Accounts is fundamentele dienste in Microsoft Azure wat skaalbare, veilige, en hoogs beskikbare cloud **storage for various data types** verskaf, insluitend blobs (binary large objects), files, queues, en tables. Hulle dien as houers wat hierdie verskillende storage dienste saam onder een enkele namespace groepeer vir maklike bestuur.
**Main configuration options**:
**Hoof konfigurasie opsies**:
- Every storage account must have a **uniq name across all Azure**.
- Every storage account is deployed in a **region** or in an Azure extended zone
- It's possible to select the **premium** version of the storage account for better performance
- It's possible to select among **4 types of redundancy to protect** against rack, drive and datacenter **failures**.
- Elke storage account moet 'n **uniq name across all Azure** hê.
- Elke storage account word ontplooi in 'n **region** of in 'n Azure extended zone
- Dit is moontlik om die **premium** weergawe van die storage account te kies vir beter performance
- Dit is moontlik om tussen **4 types of redundancy to protect** teen rack-, drive- en datacenter **failures** te kies.
**Security configuration options**:
- **Require secure transfer for REST API operations**: Require TLS in any communication with the storage
- **Allows enabling anonymous access on individual containers**: If not, it won't be possible to enable anonymous access in the future
- **Enable storage account key access**: If not, access with Shared Keys will be forbidden
- **Require secure transfer for REST API operations**: Vereis TLS in enige kommunikasie met die storage
- **Allows enabling anonymous access on individual containers**: Indien nie, sal dit in die toekoms nie moontlik wees om anonymous access te aktiveer nie
- **Enable storage account key access**: Indien nie, sal access met Shared Keys verbied word
- **Minimum TLS version**
- **Permitted scope for copy operations**: Allow from any storage account, from any storage account from the same Entra tenant or from storage account with private endpoints in the same virtual network.
- **Permitted scope for copy operations**: Laat toe vanaf enige storage account, vanaf enige storage account van dieselfde Entra tenant of vanaf storage account met private endpoints in dieselfde virtual network.
**Blob Storage options**:
- **Allow cross-tenant replication**
- **Access tier**: Hot (frequently access data), Cool and Cold (rarely accessed data)
- **Access tier**: Hot (data wat gereeld access word), Cool en Cold (data wat selde access word)
**Networking options**:
- **Network access**:
- Allow from all networks
- Allow from selected virtual networks and IP addresses
- Disable public access and use private access
- **Private endpoints**: It allows a private connection to the storage account from a virtual network
- Laat toe vanaf alle networks
- Laat toe vanaf geselekteerde virtual networks en IP addresses
- Disable public access en gebruik private access
- **Private endpoints**: Dit laat 'n private connection na die storage account vanaf 'n virtual network toe
**Data protection options**:
- **Point-in-time restore for containers**: Allows to restore containers to an earlier state
- It requires versioning, change feed, and blob soft delete to be enabled.
- **Enable soft delete for blobs**: It enables a retention period in days for deleted blobs (even overwritten)
- **Enable soft delete for containers**: It enables a retention period in days for deleted containers
- **Enable soft delete for file shares**: It enables a retention period in days for deleted file shared
- **Enable versioning for blobs**: Maintain previous versions of your blobs
- **Enable blob change feed**: Keep logs of create, modification, and delete changes to blobs
- **Enable version-level immutability support**: Allows you to set time-based retention policy on the account-level that will apply to all blob versions.
- Version-level immutability support and point-in-time restore for containers cannot be enabled simultaneously.
- **Point-in-time restore for containers**: Laat toe om containers na 'n vroeër state te restore
- Dit vereis dat versioning, change feed, en blob soft delete geaktiveer is.
- **Enable soft delete for blobs**: Dit aktiveer 'n retention period in dae vir deleted blobs (selfs overwritten)
- **Enable soft delete for containers**: Dit aktiveer 'n retention period in dae vir deleted containers
- **Enable soft delete for file shares**: Dit aktiveer 'n retention period in dae vir deleted file shared
- **Enable versioning for blobs**: Behou vorige versions van jou blobs
- **Enable blob change feed**: Hou logs van create, modification, en delete changes to blobs
- **Enable version-level immutability support**: Laat jou toe om 'n time-based retention policy op die account-level te stel wat op al die blob versions toegepas sal word.
- Version-level immutability support en point-in-time restore for containers kan nie gelyktydig geaktiveer word nie.
**Encryption configuration options**:
- **Encryption type**: It's possible to use Microsoft-managed keys (MMK) or Customer-managed keys (CMK)
- **Enable infrastructure encryption**: Allows to double encrypt the data "for more security"
- **Encryption type**: Dit is moontlik om Microsoft-managed keys (MMK) of Customer-managed keys (CMK) te gebruik
- **Enable infrastructure encryption**: Laat toe om die data dubbel te encrypt "for more security"
### Storage endpoints
@@ -62,7 +62,7 @@ Azure Storage Accounts is fundamentele services in Microsoft Azure wat skaalbare
| **Queue storage** | `https://<storage-account>.queue.core.windows.net` |
| **Table storage** | `https://<storage-account>.table.core.windows.net` |
### Publieke Blootstelling
### Public Exposure
If "Allow Blob public access" is **enabled** (disabled by default), when creating a container it's possible to:
@@ -87,21 +87,21 @@ az storage blob list --container-name '$web' --account-name <acc-name> --auth-mo
# Pull suspicious files directly (e.g., IaC tfvars containing secrets/SAS)
az storage blob download -c '$web' --name iac/terraform.tfvars --file /dev/stdout --account-name <acc-name> --auth-mode login
```
### Auditing anonymous blob exposure
### Ouditering van anonieme blob-blootstelling
- **Lokaliseer storage accounts** wat data kan blootstel: `az storage account list | jq -r '.[] | select(.properties.allowBlobPublicAccess==true) | .name'`. As `allowBlobPublicAccess` `false` is, kan jy nie containers public maak nie.
- **Inspekteer riskante accounts** om die flag en ander swak settings te bevestig: `az storage account show --name <acc> --query '{allow:properties.allowBlobPublicAccess, minTls:properties.minimumTlsVersion}'`.
- **Enumereer container-level exposure** waar die flag geaktiveer is:
- **Vind storage accounts** wat data kan blootstel: `az storage account list | jq -r '.[] | select(.properties.allowBlobPublicAccess==true) | .name'`. As `allowBlobPublicAccess` `false` is, kan jy nie containers publiek maak nie.
- **Inspekteer riskante accounts** om die vlag en ander swak settings te bevestig: `az storage account show --name <acc> --query '{allow:properties.allowBlobPublicAccess, minTls:properties.minimumTlsVersion}'`.
- **Lys container-vlak blootstelling** waar die vlag geaktiveer is:
```bash
az storage container list --account-name <acc> \
--query '[].{name:name, access:properties.publicAccess}'
```
- `"Blob"`: anonieme leeswerk is slegs toegelaat **wanneer die blob-naam bekend is** (geen lysing).
- `"Container"`: anonieme **lys + lees** van elke blob.
- `null`: privaat; verifikasie vereis.
- **Bewys toegang** sonder credentials:
- As `publicAccess` `Container` is, werk anonieme lysing: `curl "https://<acc>.blob.core.windows.net/<container>?restype=container&comp=list"`.
- Vir beide `Blob` en `Container`, werk anonieme blob-aflaai wanneer die naam bekend is:
- `"Blob"`: anonieme lees toegang toegelaat **slegs wanneer blob name bekend is** (geen listing).
- `"Container"`: anonieme **list + read** van elke blob.
- `null`: private; authentication vereis.
- **Bewys access** sonder credentials:
- As `publicAccess` `Container` is, werk anonieme listing: `curl "https://<acc>.blob.core.windows.net/<container>?restype=container&comp=list"`.
- Vir beide `Blob` en `Container`, werk anonieme blob download wanneer die naam bekend is:
```bash
az storage blob download -c <container> -n <blob> --account-name <acc> --file /dev/stdout
# or via raw HTTP
@@ -109,13 +109,13 @@ curl "https://<acc>.blob.core.windows.net/<container>/<blob>"
```
### Connect to Storage
As jy enige **storage** vind waartoe jy kan koppel, kan jy die [**Microsoft Azure Storage Explorer**](https://azure.microsoft.com/es-es/products/storage/storage-explorer/) tool gebruik om dit te doen.
As jy enige **storage** vind waartoe jy kan koppel, kan jy die tool [**Microsoft Azure Storage Explorer**](https://azure.microsoft.com/es-es/products/storage/storage-explorer/) gebruik om dit te doen.
## Access to Storage <a href="#about-blob-storage" id="about-blob-storage"></a>
### RBAC
Dit is moontlik om Entra ID principals met **RBAC roles** te gebruik om toegang tot storage accounts te kry, en dit is die aanbevole manier.
Dit is moontlik om Entra ID principals met **RBAC roles** te gebruik om toegang tot storage accounts te verkry, en dit is die aanbevole manier.
### Access Keys
@@ -125,15 +125,15 @@ Die storage accounts het access keys wat gebruik kan word om toegang daartoe te
### **Shared Keys & Lite Shared Keys**
Dit is moontlik om [**Shared Keys te genereer**](https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-with-shared-key) wat met die access keys onderteken is om toegang tot sekere resources via 'n signed URL te authoriseer.
Dit is moontlik om [**Shared Keys**](https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-with-shared-key) te genereer wat met die access keys onderteken is om toegang tot sekere resources via 'n signed URL te authoriseer.
> [!NOTE]
> Let daarop dat die `CanonicalizedResource`-deel die storage services resource (URI) verteenwoordig. En as enige deel in die URL geënkodeer is, moet dit ook binne die `CanonicalizedResource` geënkodeer word.
> Let daarop dat die `CanonicalizedResource`-deel die storage services resource (URI) verteenwoordig. En as enige deel in die URL ge-encode is, moet dit ook binne die `CanonicalizedResource` ge-encode wees.
> [!NOTE]
> Dit word by verstek deur `az` cli gebruik om requests te authenticate. Om dit te laat gebruik die Entra ID principal credentials, dui die param `--auth-mode login` aan.
> Dit word by verstek deur `az` cli gebruik om requests te authenticate. Om dit te laat gebruik maak van die Entra ID principal credentials, dui die param `--auth-mode login` aan.
- Dit is moontlik om 'n **shared key for blob, queue and file services** te genereer deur die volgende inligting te onderteken:
- Dit is moontlik om 'n **shared key vir blob, queue en file services** te genereer deur die volgende information te onderteken:
```bash
StringToSign = VERB + "\n" +
Content-Encoding + "\n" +
@@ -150,7 +150,7 @@ Range + "\n" +
CanonicalizedHeaders +
CanonicalizedResource;
```
- Dit is moontlik om 'n **shared key for table services** te genereer deur die volgende inligting te onderteken:
- Dit is moontlik om 'n **shared key for table services** te genereer deur die volgende inligting te teken:
```bash
StringToSign = VERB + "\n" +
Content-MD5 + "\n" +
@@ -158,7 +158,7 @@ Content-Type + "\n" +
Date + "\n" +
CanonicalizedResource;
```
- Dit is moontlik om 'n **lite shared key vir blob, queue en file services** te genereer deur die volgende inligting te onderteken:
- Dit is moontlik om 'n **lite shared key for blob, queue and file services** te genereer deur die volgende inligting te teken:
```bash
StringToSign = VERB + "\n" +
Content-MD5 + "\n" +
@@ -172,7 +172,7 @@ CanonicalizedResource;
StringToSign = Date + "\n"
CanonicalizedResource
```
Dan, om die key te gebruik, kan dit in die Authorization header gedoen word volgens die sintaks:
Dan, om die sleutel te gebruik, kan dit gedoen word in die Authorization-kopskrif volgens die sintaksis:
```bash
Authorization="[SharedKey|SharedKeyLite] <AccountName>:<Signature>"
#e.g.
@@ -186,20 +186,20 @@ Content-Length: 0
```
### **Shared Access Signature** (SAS)
Shared Access Signatures (SAS) is secure, time-beperkte URLs wat **spesifieke permissions aan resources** in ’n Azure Storage account gee sonder om die account se access keys bloot te stel. Terwyl access keys volle administrative access tot alle resources bied, laat SAS fynkorrelige control toe deur permissions te spesifiseer (soos read of write) en ’n vervaldatum te definieer.
Shared Access Signatures (SAS) is veilige, tydsbeperkte URL's wat **spesifieke permissions gee om resources te access** in 'n Azure Storage account sonder om die account se access keys bloot te stel. Terwyl access keys volle administrative access tot alle resources gee, laat SAS fynkorrelige control toe deur permissions te spesifiseer (soos read of write) en 'n vervaltyd te definieer.
#### SAS Types
- **User delegation SAS**: Dit word geskep vanaf ’n **Entra ID principal** wat die SAS sal teken en die permissions van die user na die SAS delegeer. Dit kan slegs met **blob and data lake storage** gebruik word ([docs](https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas)). Dit is moontlik om alle gegenereerde user delegated SAS te **revoke**.
- Selfs al is dit moontlik om ’n delegation SAS met "meer" permissions te genereer as dié wat die user het, sal dit nie werk as die principal dit nie het nie (geen privesc).
- **Service SAS**: Dit word geteken met een van die storage account **access keys**. Dit kan gebruik word om access tot spesifieke resources in ’n enkele storage service te gee. As die key hernu word, sal die SAS ophou werk.
- **Account SAS**: Dit word ook geteken met een van die storage account **access keys**. Dit gee access tot resources oor ’n storage account se services (Blob, Queue, Table, File) en kan service-level operations insluit.
- **User delegation SAS**: Dit word geskep vanaf 'n **Entra ID principal** wat die SAS sal sign en die permissions van die user na die SAS sal delegate. Dit kan net met **blob and data lake storage** gebruik word ([docs](https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas)). Dit is moontlik om alle gegenereerde user delegated SAS te **revoke**.
- Selfs al is dit moontlik om 'n delegation SAS met "meer" permissions te genereer as wat die user het. As die principal dit nie het nie, sal dit nie werk nie (no privesc).
- **Service SAS**: Dit word gesign met een van die storage account **access keys**. Dit kan gebruik word om access tot spesifieke resources in 'n enkele storage service te gee. As die key hernu word, sal die SAS ophou werk.
- **Account SAS**: Dit word ook met een van die storage account **access keys** gesign. Dit gee access tot resources oor 'n storage account services (Blob, Queue, Table, File) en kan service-level operations insluit.
’n SAS URL wat deur ’n **access key** geteken is, lyk so:
'n SAS URL wat deur 'n **access key** gesign is, lyk so:
- `https://<container_name>.blob.core.windows.net/newcontainer?sp=r&st=2021-09-26T18:15:21Z&se=2021-10-27T02:14:21Z&spr=https&sv=2021-07-08&sr=c&sig=7S%2BZySOgy4aA3Dk0V1cJyTSIf1cW%2Fu3WFkhHV32%2B4PE%3D`
’n SAS URL wat as ’n **user delegation** geteken is, lyk so:
'n SAS URL wat as 'n **user delegation** gesign is, lyk so:
- `https://<container_name>.blob.core.windows.net/testing-container?sp=r&st=2024-11-22T15:07:40Z&se=2024-11-22T23:07:40Z&skoid=d77c71a1-96e7-483d-bd51-bd753aa66e62&sktid=fdd066e1-ee37-49bc-b08f-d0e152119b04&skt=2024-11-22T15:07:40Z&ske=2024-11-22T23:07:40Z&sks=b&skv=2022-11-02&spr=https&sv=2022-11-02&sr=c&sig=7s5dJyeE6klUNRulUj9TNL0tMj2K7mtxyRc97xbYDqs%3D`
@@ -211,43 +211,43 @@ Let op sommige **http params**:
#### SAS permissions
Wanneer ’n SAS gegenereer word, moet jy die permissions aandui wat dit behoort te gee. Afhangend van die object waarvoor die SAS gegenereer word, kan verskillende permissions ingesluit word. Byvoorbeeld:
Wanneer 'n SAS gegenereer word, is dit nodig om die permissions aan te dui wat dit moet gee. Afhangend van die object waaroor die SAS gegenereer word, kan verskillende permissions ingesluit word. Byvoorbeeld:
- (a)dd, (c)reate, (d)elete, (e)xecute, (f)ilter_by_tags, (i)set_immutability_policy, (l)ist, (m)ove, (r)ead, (t)ag, (w)rite, (x)delete_previous_version, (y)permanent_delete
## SFTP Support for Azure Blob Storage
Azure Blob Storage ondersteun nou die SSH File Transfer Protocol (SFTP), wat veilige file transfer en management direk na Blob Storage moontlik maak sonder om custom solutions of third-party products te benodig.
Azure Blob Storage ondersteun nou die SSH File Transfer Protocol (SFTP), wat veilige file transfer en management direk na Blob Storage moontlik maak sonder om custom solutions of third-party products te vereis.
### Key Features
- Protocol Support: SFTP werk met Blob Storage accounts wat met hierarchical namespace (HNS) gekonfigureer is. Dit organiseer blobs in directories en subdirectories vir makliker navigation.
- Security: SFTP gebruik local user identities vir authentication en integreer nie met RBAC of ABAC nie. Elke local user kan via authenticate:
- Security: SFTP kan local user identities gebruik, maar dit ondersteun ook Microsoft Entra ID-gebaseerde access met Azure RBAC vir authorization. Dit beteken access kan gegee word met die gewone Blob Storage data-plane roles in plaas daarvan om local SFTP users te skep. Local users kan autentikeer via:
- Azure-generated passwords
- Public-private SSH key pairs
- Granular Permissions: Permissions soos Read, Write, Delete, en List kan aan local users toegewys word vir tot 100 containers.
- Networking Considerations: SFTP connections word deur port 22 gemaak. Azure ondersteun network configurations soos firewalls, private endpoints, of virtual networks om SFTP traffic te beveilig.
- Networking Considerations: SFTP connections word deur port 22 gemaak. Azure ondersteun network configurations soos firewalls, private endpoints, of virtual networks om SFTP traffic te secure.
### Setup Requirements
- Hierarchical Namespace: HNS moet ge-enable wees wanneer die storage account geskep word.
- Hierarchical Namespace: HNS moet geaktiveer wees wanneer die storage account geskep word.
- Supported Encryption: Vereis Microsoft Security Development Lifecycle (SDL)-goedgekeurde cryptographic algorithms (bv. rsa-sha2-256, ecdsa-sha2-nistp256).
- SFTP Configuration:
- Enable SFTP op die storage account.
- Skep local user identities met toepaslike permissions.
- Configure home directories vir users om hul beginligging binne die container te definieer.
- Skakel SFTP op die storage account aan.
- Vir local-user access, skep local user identities met toepaslike permissions.
- Vir local users, configureer home directories om hul beginligging binne die container te definieer.
### Permissions
| Permission | Symbol | Description |
| ---------------------- | ------ | ------------------------------------ |
| **Read** | `r` | Read file content. |
| **Write** | `w` | Upload files and create directories. |
| **List** | `l` | List contents of directories. |
| **Delete** | `d` | Delete files or directories. |
| **Create** | `c` | Create files or directories. |
| **Modify Ownership** | `o` | Change the owning user or group. |
| **Modify Permissions** | `p` | Change ACLs on files or directories. |
| **Read** | `r` | Lees file content. |
| **Write** | `w` | Laai files op en skep directories. |
| **List** | `l` | Lys contents van directories. |
| **Delete** | `d` | Delete files of directories. |
| **Create** | `c` | Skep files of directories. |
| **Modify Ownership** | `o` | Verander die owning user of group. |
| **Modify Permissions** | `p` | Verander ACLs op files of directories. |
## Enumeration
@@ -471,6 +471,7 @@ az-file-shares.md
- [https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction)
- [https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview](https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview)
- [https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support](https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support)
- [https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support-entra-id-based-access](https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support-entra-id-based-access)
- [Holiday Hack Challenge 2025 – Spare Key (Azure static website SAS leak)](https://0xdf.gitlab.io/holidayhack2025/act1/spare-key)
- [Holiday Hack Challenge 2025: Blob Storage (Storage Secrets)](https://0xdf.gitlab.io/holidayhack2025/act1/blob-storage)
- [https://learn.microsoft.com/en-us/cli/azure/storage/account](https://learn.microsoft.com/en-us/cli/azure/storage/account)