From be34f8fd0db1c1f17483dd8c0529ed771f4b617d Mon Sep 17 00:00:00 2001 From: Translator Date: Sun, 18 Jan 2026 15:03:53 +0000 Subject: [PATCH] Translated ['', 'src/pentesting-cloud/azure-security/az-services/az-stor --- .../azure-security/az-services/az-storage.md | 176 ++++++++++-------- 1 file changed, 96 insertions(+), 80 deletions(-) diff --git a/src/pentesting-cloud/azure-security/az-services/az-storage.md b/src/pentesting-cloud/azure-security/az-services/az-storage.md index 28a8cacbd..61cca1692 100644 --- a/src/pentesting-cloud/azure-security/az-services/az-storage.md +++ b/src/pentesting-cloud/azure-security/az-services/az-storage.md @@ -4,114 +4,129 @@ ## Taarifa za Msingi -Azure Storage Accounts ni huduma za msingi katika Microsoft Azure zinazotoa **storage ya wingu inayoweza kupanuka, yenye usalama, na inayopatikana kwa urahisi** kwa aina mbalimbali za data, ikiwa ni pamoja na blobs (binary large objects), files, queues, na tables. Zinatumika kama containers zinazokusanya huduma tofauti za storage chini ya namespace moja kwa usimamizi rahisi. +Azure Storage Accounts ni huduma za msingi kwenye Microsoft Azure zinazotoa **storage inayoweza kupanuka, salama, na yenye upatikanaji mkubwa** kwa aina mbalimbali za data, ikiwa ni pamoja na blobs (binary large objects), files, queues, na tables. Zinatumika kama containers zinazokusanya huduma hizi za storage tofauti chini ya namespace moja kwa usimamizi rahisi. **Chaguzi kuu za usanidi**: -- Kila storage account lazima iwe na **jina la kipekee kwa Azure nzima**. -- Kila storage account inawekwa katika **eneo** au katika Azure extended zone +- Kila storage account lazima iwe na **jina la kipekee kwenye Azure yote**. +- Kila storage account inawekwa katika **mkoa** au katika Azure extended zone - Inawezekana kuchagua toleo la **premium** la storage account kwa utendaji bora -- Inawezekana kuchagua kati ya **aina 4 za redundancy ili kulinda** dhidi ya kushindwa kwa rack, drive na datacenter (**failures**). +- Inawezekana kuchagua kati ya **aina 4 za redundancy za kulinda** dhidi ya kushindwa kwa rack, drive na datacenter. **Chaguzi za usanidi wa usalama**: -- **Require secure transfer for REST API operations**: Leta TLS katika mawasiliano yote na storage -- **Allows enabling anonymous access on individual containers**: Ikiwa haijawekwa, haitakuwa inawezekana kuwezesha anonymous access baadaye -- **Enable storage account key access**: Ikiwa haijawezeshwa, ufikiaji kwa Shared Keys utakatazwa +- **Require secure transfer for REST API operations**: Inaleta TLS kwa mawasiliano yote na storage +- **Allows enabling anonymous access on individual containers**: Ikiwa haijaruhusiwa, haitakuwa inawezekana kuwezesha anonymous access baadaye +- **Enable storage account key access**: Ikiwa haijaruhusiwa, ufikiaji kwa Shared Keys utakatazwa - **Minimum TLS version** -- **Permitted scope for copy operations**: Ruhusu kutoka kwa storage account yoyote, kutoka kwa storage account yoyote kutoka kwa Entra tenant ileile au kutoka kwa storage account zenye private endpoints katika virtual network ileile. +- **Permitted scope for copy operations**: Ruhusu kutoka kwenye storage account yoyote, kutoka kwenye storage account yoyote kutoka kwa Entra tenant ileile au kutoka kwenye storage account yenye private endpoints kwenye virtual network ileile. **Chaguzi za Blob Storage**: - **Allow cross-tenant replication** - **Access tier**: Hot (data inayofikiwa mara kwa mara), Cool na Cold (data inayofikiwa nadra) -**Chaguzi za mtandao**: +**Chaguzi za Networking**: - **Network access**: - Ruhusu kutoka mitandao yote - Ruhusu kutoka virtual networks na anwani za IP zilizochaguliwa - Zima public access na tumia private access -- **Private endpoints**: Inaruhusu muunganisho wa kibinafsi kwa storage account kutoka virtual network +- **Private endpoints**: Inaruhusu muunganisho binafsi kwa storage account kutoka virtual network **Chaguzi za ulinzi wa data**: - **Point-in-time restore for containers**: Inaruhusu kurejesha containers hadi hali ya awali -- Inahitaji kuwa versioning, change feed, na blob soft delete vimewezeshwa. -- **Enable soft delete for blobs**: Inawezesha kipindi cha retention kwa siku kwa blobs zilizofutwa (hata zilizofunikwa) -- **Enable soft delete for containers**: Inawezesha kipindi cha retention kwa siku kwa containers zilizofutwa -- **Enable soft delete for file shares**: Inawezesha kipindi cha retention kwa siku kwa file shares zilizofutwa -- **Enable versioning for blobs**: Hifadhi matoleo ya awali ya blobs zako -- **Enable blob change feed**: Hifadhi logi za kuunda, kubadilisha, na kufuta mabadiliko ya blobs -- **Enable version-level immutability support**: Inakuwezesha kuweka sera ya retention inayotegemea muda kwenye ngazi ya akaunti ambayo itahusisha matoleo yote ya blob. +- Inahitaji versioning, change feed, na blob soft delete ziwe zimeshazwa. +- **Enable soft delete for blobs**: Inawasifu kipindi cha retention kwa siku kwa blobs zilizofutwa (hata zile zilizopigwa overwrite) +- **Enable soft delete for containers**: Inawasifu kipindi cha retention kwa siku kwa containers zilizofutwa +- **Enable soft delete for file shares**: Inawasifu kipindi cha retention kwa siku kwa file shares zilizofutwa +- **Enable versioning for blobs**: Hifadhi toleo za awali za blobs zako +- **Enable blob change feed**: Hifadhi logu za kuunda, kuhariri, na kufuta mabadiliko kwa blobs +- **Enable version-level immutability support**: Inakuruhusu kuweka sera ya retention ya muda kwa kiwango cha account ambayo itawezekana kwa toleo zote za blob. - Version-level immutability support na point-in-time restore for containers haiwezi kuwezeshwa kwa wakati mmoja. -**Chaguzi za usanidi wa encryption**: +**Chaguzi za encryption**: - **Encryption type**: Inawezekana kutumia Microsoft-managed keys (MMK) au Customer-managed keys (CMK) -- **Enable infrastructure encryption**: Inaruhusu kukataza data mara mbili "kwa usalama zaidi" +- **Enable infrastructure encryption**: Inaruhusu kujaza data kwa encryption mara mbili "kwa usalama zaidi" ### Storage endpoints -
Huduma za StorageEndpoint
Blob storagehttps://<storage-account>.blob.core.windows.net

https://<stg-acc>.blob.core.windows.net/<container-name>?restype=container&comp=list
Data Lake Storagehttps://<storage-account>.dfs.core.windows.net
Azure Fileshttps://<storage-account>.file.core.windows.net
Queue storagehttps://<storage-account>.queue.core.windows.net
Table storagehttps://<storage-account>.table.core.windows.net
+
Storage ServiceEndpoint
Blob storagehttps://.blob.core.windows.net

https://.blob.core.windows.net/?restype=container&comp=list
Data Lake Storagehttps://.dfs.core.windows.net
Azure Fileshttps://.file.core.windows.net
Queue storagehttps://.queue.core.windows.net
Table storagehttps://.table.core.windows.net
-### Ufunuo wa Umma +### Public Exposure -Ikiwa "Allow Blob public access" imewezeshwa (imezimwa kwa chaguo-msingi), wakati wa kuunda container inawezekana: +Ikiwa "Allow Blob public access" imewezeshwa (imezimwa kwa default), wakati wa kuunda container inawezekana: -- Kutoa **public access to read blobs** (unahitaji kujua jina). -- **List container blobs** na **kisome**. -- Kufanya iwe kabisa **private** +- Kutoa **public access to read blobs** (inahitaji kujua jina). +- **List container blobs** na **read** hizo. +- Fanya kuwa kabisa **private**
-#### Kukagua ufunuo wa blob za anonymous +### Static website (`$web`) exposure & leaked secrets -- **Tafuta storage accounts** ambazo zinaweza kufunua data: `az storage account list | jq -r '.[] | select(.properties.allowBlobPublicAccess==true) | .name'`. Ikiwa `allowBlobPublicAccess` ni `false` huwezi kufanya containers kuwa public. -- **Chunguza akaunti zenye hatari** ili kuthibitisha flag na mipangilio mingine dhaifu: `az storage account show --name --query '{allow:properties.allowBlobPublicAccess, minTls:properties.minimumTlsVersion}'`. -- **Orodhesha ufunuo wa ngazi ya container** ambapo flag imewezeshwa: +- **Static websites** hutolewa kutoka kwa container maalumu `$web` juu ya endpoint maalumu kwa mkoa kama `https://.z13.web.core.windows.net/`. +- Container ya `$web` inaweza kuripoti `publicAccess: null` kupitia blob API, lakini faili bado zinaweza kupatikana kupitia static site endpoint, hivyo kuacha artifacts za config/IaC huko kunaweza kusababisha leaked secrets. +- Quick audit workflow: +```bash +# Identify storage accounts with static website hosting enabled +az storage blob service-properties show --account-name --auth-mode login +# Enumerate containers (including $web) and their public flags +az storage container list --account-name --auth-mode login +# List files served by the static site even when publicAccess is null +az storage blob list --container-name '$web' --account-name --auth-mode login +# Pull suspicious files directly (e.g., IaC tfvars containing secrets/SAS) +az storage blob download -c '$web' --name iac/terraform.tfvars --file /dev/stdout --account-name --auth-mode login +``` +### Ukaguzi wa uwazi wa blob zisizo za jina + +- **Gundua akaunti za kuhifadhi** ambazo zinaweza kuonyesha data: `az storage account list | jq -r '.[] | select(.properties.allowBlobPublicAccess==true) | .name'`. Ikiwa `allowBlobPublicAccess` ni `false` huwezi kufanya containers kuwa za umma. +- **Kagua akaunti hatarishi** ili kuthibitisha bendera na mipangilio mingine dhaifu: `az storage account show --name --query '{allow:properties.allowBlobPublicAccess, minTls:properties.minimumTlsVersion}'`. +- **Orodhesha uwekaji wazi kwa ngazi ya container** kwenye akaunti ambapo bendera imewezeshwa: ```bash az storage container list --account-name \ --query '[].{name:name, access:properties.publicAccess}' ``` -- `"Blob"`: usomaji wa watu wasiojulikana unaruhusiwa **tu wakati jina la blob linajulikana** (hakuna kuorodhesha). -- `"Container"`: watu wasiojulikana wanaweza **kuorodhesha + kusoma** blob zote. -- `null`: binafsi; uthibitishaji unahitajika. -- **Thibitisha upatikanaji** bila kredensiali: -- Ikiwa `publicAccess` ni `Container`, kuorodhesha kwa wasiojulikana kunafanya kazi: `curl "https://.blob.core.windows.net/?restype=container&comp=list"`. -- Kwa `Blob` na `Container`, kupakua blob kwa wasiojulikana kunafanya kazi wakati jina linajulikana: +- `"Blob"`: anonymous reads zinazoruhusiwa **tu wakati jina la blob linajulikana** (hakuna listing). +- `"Container"`: anonymous **list + read** ya kila blob. +- `null`: binafsi; authentication inahitajika. +- **Thibitisha upatikanaji** bila credentials: +- Ikiwa `publicAccess` ni `Container`, anonymous listing inafanya kazi: `curl "https://.blob.core.windows.net/?restype=container&comp=list"`. +- Kwa zote `Blob` na `Container`, anonymous blob download inafanya kazi wakati jina linajulikana: ```bash az storage blob download -c -n --account-name --file /dev/stdout # or via raw HTTP curl "https://.blob.core.windows.net//" ``` -### Ungana na Hifadhi +### Ungana na Storage -Ikiwa utapata **hifadhi** yoyote ambayo unaweza kuiunganisha, unaweza kutumia zana [**Microsoft Azure Storage Explorer**](https://azure.microsoft.com/es-es/products/storage/storage-explorer/) kufanya hivyo. +Kama utapata **storage** yoyote unayoweza kuungana nayo, unaweza kutumia zana [**Microsoft Azure Storage Explorer**](https://azure.microsoft.com/es-es/products/storage/storage-explorer/) kufanya hivyo. -## Upatikanaji wa Hifadhi +## Ufikiaji wa Storage ### RBAC -Inawezekana kutumia Entra ID principals pamoja na **RBAC roles** kufikia akaunti za hifadhi, na hii ndiyo njia inayopendekezwa. +Inawezekana kutumia Entra ID principals pamoja na **RBAC roles** kupata ufikiaji wa storage accounts, na hii ndiyo njia inayopendekezwa. ### Access Keys -Akaunti za hifadhi zina vifunguo vya ufikiaji ambavyo vinaweza kutumika kuifikia. Hii inatoa **ufikiaji kamili kwa akaunti ya hifadhi.** +Storage accounts zina access keys ambazo zinaweza kutumika kuzipata. Hii inatoa f**ull access to the storage account.**
### **Shared Keys & Lite Shared Keys** -It's possible to [**generate Shared Keys**](https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-with-shared-key) signed with the access keys to authorize access to certain resources via a signed URL. +Inawezekana [**generate Shared Keys**](https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-with-shared-key) zilizotiwa saini na access keys ili kuruhusu ufikiaji wa rasilimali fulani kupitia signed URL. > [!NOTE] > Kumbuka kwamba sehemu ya `CanonicalizedResource` inaonyesha rasilimali ya storage services (URI). Na ikiwa sehemu yoyote ya URL imekodishwa (encoded), inapaswa pia kukodishwa ndani ya `CanonicalizedResource`. > [!NOTE] -> Hii **inatumika kwa chaguo-msingi na `az` cli** kuthibitisha maombi. Ili kuifanya itumie credentials za Entra ID principal, taja param `--auth-mode login`. +> Hii ni **imetumiwa kwa chaguo-msingi na `az` cli** kuthibitisha maombi. Ili kufanya itumie Entra ID principal credentials, taja param `--auth-mode login`. -- Inawezekana kuunda **shared key for blob, queue and file services** kwa kusaini taarifa zifuatazo: +- Inawezekana kuunda a **shared key for blob, queue and file services** kwa kusaini taarifa zifuatazo: ```bash StringToSign = VERB + "\n" + Content-Encoding + "\n" + @@ -128,7 +143,7 @@ Range + "\n" + CanonicalizedHeaders + CanonicalizedResource; ``` -- Inawezekana kuunda **shared key for table services** kwa kusaini taarifa zifuatazo: +- Inawezekana kutengeneza **funguo ya pamoja kwa huduma za jedwali** kwa kusaini taarifa zifuatazo: ```bash StringToSign = VERB + "\n" + Content-MD5 + "\n" + @@ -136,7 +151,7 @@ Content-Type + "\n" + Date + "\n" + CanonicalizedResource; ``` -- Inawezekana kuunda **lite shared key for blob, queue and file services** kwa kusaini taarifa zifuatazo: +- Inawezekana kuzalisha **lite shared key for blob, queue and file services** kwa kusaini taarifa zifuatazo: ```bash StringToSign = VERB + "\n" + Content-MD5 + "\n" + @@ -150,7 +165,7 @@ CanonicalizedResource; StringToSign = Date + "\n" CanonicalizedResource ``` -Kisha, ili kutumia key, inaweza kufanywa kwenye Authorization header kwa kuzingatia sintaksi: +Kisha, ili kutumia key, inaweza kufanywa katika Authorization header kwa kufuata sintaksia: ```bash Authorization="[SharedKey|SharedKeyLite] :" #e.g. @@ -164,14 +179,14 @@ Content-Length: 0 ``` ### **Shared Access Signature** (SAS) -Shared Access Signatures (SAS) ni URLs salama, zenye muda wa kuisha ambazo zinatoa **ruhusa maalum za kufikia rasilimali** katika akaunti ya Azure Storage bila kufichua access keys za akaunti. Wakati access keys zinatoa ufikiaji wa utawala kamili kwa rasilimali zote, SAS inaruhusu udhibiti wa kina kwa kubainisha ruhusa (kama read au write) na kuweka muda wa kumalizika. +Shared Access Signatures (SAS) ni URLs salama, zilizopangwa kwa muda ambazo zinatoa ruhusa maalum za kufikia rasilimali katika akaunti ya Azure Storage bila kufichua access keys za akaunti. Wakati access keys zinatoa ufikiaji wa kiutawala kwa rasilimali zote, SAS inaruhusu udhibiti wa kina kwa kubainisha ruhusa (kama read au write) na kuweka muda wa kumalizika. #### SAS Types -- **User delegation SAS**: Hii inaundwa kutoka kwa **Entra ID principal** ambaye atasaini SAS na kuhamishia ruhusa kutoka kwa mtumiaji hadi SAS. Inaweza kutumika tu na **blob and data lake storage** ([docs](https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas)). Inawezekana **kubatilisha** SAS zote za user delegated zilizotengenezwa. -- Ingawa inawezekana kutengeneza delegation SAS yenye ruhusa "za ziada" kuliko zile mtumiaji anazo, ikiwa principal hana ruhusa hizo, haitafanya kazi (hakuna privesc). -- **Service SAS**: Hii imesainiwa kwa kutumia moja ya storage account **access keys**. Inaweza kutumika kutoa ufikiaji kwa rasilimali maalum ndani ya huduma moja ya storage. Ikiwa key itafanywa upya, SAS itasimama kufanya kazi. -- **Account SAS**: Pia imesainiwa kwa kutumia moja ya storage account **access keys**. Inatoa ufikiaji kwa rasilimali katika huduma mbalimbali za akaunti ya storage (Blob, Queue, Table, File) na inaweza kujumuisha operesheni za kiwango cha huduma. +- **User delegation SAS**: Hii inaundwa kutoka kwa Entra ID principal ambayo itasaini SAS na kurithisha ruhusa kutoka kwa mtumiaji hadi SAS. Inaweza kutumika tu na blob and data lake storage ([docs](https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas)). Inawezekana kufuta SAS zote zilizotengenezwa za user delegated SAS. +- Hata ikiwa inawezekana kuunda delegation SAS yenye ruhusa "za ziada" kuliko zile mtumiaji anazomiliki, ikiwa principal haina ruhusa hizo, haitafanya kazi (no privesc). +- **Service SAS**: Hii imesainiwa kwa kutumia moja ya storage account access keys. Inaweza kutumika kutoa ufikiaji kwa rasilimali maalum katika huduma moja ya storage. Ikiwa key inarekebishwa/kuwekwa upya, SAS itasimama kufanya kazi. +- **Account SAS**: Pia imesainiwa kwa kutumia moja ya storage account access keys. Inatoa ufikiaji kwa rasilimali katika huduma mbalimbali za storage account (Blob, Queue, Table, File) na inaweza kujumuisha operesheni za ngazi ya huduma. A SAS URL signed by an **access key** looks like this: @@ -183,57 +198,57 @@ A SAS URL signed as a **user delegation** looks like this: Note some **http params**: -- Param ya **`se`** inaonyesha **tarehe ya kumalizika** ya SAS -- Param ya **`sp`** inaonyesha **ruhusa** za SAS -- **`sig`** ni **sahihi** inayothibitisha SAS +- The **`se`** param indicates the **expiration date** of the SAS +- The **`sp`** param indicates the **permissions** of the SAS +- The **`sig`** is the **signature** validating the SAS #### SAS permissions -Unapounda SAS inahitajika kuonyesha ruhusa zitakazotolewa. Kutegemea kwenye object ambayo SAS inaundwa juu yake, ruhusa mbalimbali zinaweza kujumuishwa. Kwa mfano: +Wakati wa kuunda SAS, inahitajika kubainisha ruhusa ambazo inapaswa kutoa. Kulingana na kitu (object) ambacho SAS imetengenezwa juu yake, ruhusa tofauti zinaweza kujumuishwa. Kwa mfano: - (a)dd, (c)reate, (d)elete, (e)xecute, (f)ilter_by_tags, (i)set_immutability_policy, (l)ist, (m)ove, (r)ead, (t)ag, (w)rite, (x)delete_previous_version, (y)permanent_delete ## SFTP Support for Azure Blob Storage -Azure Blob Storage sasa inaunga mkono SSH File Transfer Protocol (SFTP), ikiruhusu uhamishaji wa faili uliosalama na usimamizi moja kwa moja kwenye Blob Storage bila kuhitaji suluhisho maalum au bidhaa za wahusika wa tatu. +Azure Blob Storage sasa inaunga mkono SSH File Transfer Protocol (SFTP), ikiruhusu uhamisho wa faili uliosahala na usimamizi moja kwa moja hadi Blob Storage bila kuhitaji suluhisho maalum au bidhaa za third-party. ### Key Features -- Protocol Support: SFTP inafanya kazi na akaunti za Blob Storage zilizo na hierarchical namespace (HNS) imewezeshwa. Hii inaandaa blobs kwenye saraka na saraka ndogo kwa urahisi wa kuvinjari. -- Security: SFTP inatumia vitambulisho vya watumiaji wa ndani kwa uthibitisho na haishirikiani na RBAC au ABAC. Kila mtumiaji wa ndani anaweza kuthibitishwa kupitia: - - Azure-generated passwords - - Public-private SSH key pairs -- Granular Permissions: Ruhusa kama Read, Write, Delete, na List zinaweza kupangiwa watumiaji wa ndani kwa hadi containers 100. -- Networking Considerations: Muunganisho wa SFTP hufanywa kupitia port 22. Azure inasaidia usanidi wa mtandao kama firewalls, private endpoints, au virtual networks ili kufanya trafiki ya SFTP kuwa salama. +- Protocol Support: SFTP inafanya kazi na akaunti za Blob Storage zilizo na hierarchical namespace (HNS) iliyowekwa. Hii ina kupanga blobs katika directories na subdirectories kwa urahisi wa kuvinjari. +- Security: SFTP inatumia local user identities kwa authentication na haijumuishi RBAC au ABAC. Kila local user anaweza ku-authenticate kupitia: +- Azure-generated passwords +- Public-private SSH key pairs +- Granular Permissions: Ruhusa kama Read, Write, Delete, na List zinaweza kupewa local users hadi kwa containers 100. +- Networking Considerations: Mikuozo ya SFTP hufanywa kupitia port 22. Azure inaunga mkono mipangilio ya mtandao kama firewalls, private endpoints, au virtual networks ili kulinda trafiki ya SFTP. ### Setup Requirements -- Hierarchical Namespace: HNS lazima iwe imewezeshwa wakati wa kuunda akaunti ya storage. -- Supported Encryption: Inahitaji algorithimu za kriptografia zilizoidhinishwa na Microsoft Security Development Lifecycle (SDL) (mfano, rsa-sha2-256, ecdsa-sha2-nistp256). +- Hierarchical Namespace: HNS lazima iwe imewekwa wakati wa kuunda storage account. +- Supported Encryption: Inahitaji cryptographic algorithms zilizokubaliwa na Microsoft Security Development Lifecycle (SDL) (mfano: rsa-sha2-256, ecdsa-sha2-nistp256). - SFTP Configuration: - - Wezesha SFTP kwenye akaunti ya storage. - - Tengeneza vitambulisho vya watumiaji wa ndani na ruhusa zinazofaa. - - Panga saraka za nyumbani (home directories) kwa watumiaji ili kufafanua mahali pa kuanzia ndani ya container. +- Enable SFTP on the storage account. +- Create local user identities with appropriate permissions. +- Configure home directories for users to define their starting location within the container. ### Permissions | Ruhusa | Alama | Maelezo | | ---------------------- | ------ | ------------------------------------ | -| **Soma** | `r` | Soma yaliyomo ya faili. | -| **Andika** | `w` | Pakia faili na tengeneza saraka. | -| **Orodhesha** | `l` | Orodhesha yaliyomo ya saraka. | -| **Futa** | `d` | Futa faili au saraka. | -| **Tengeneza** | `c` | Tengeneza faili au saraka. | -| **Badilisha Umiliki** | `o` | Badilisha mtumiaji au kundi mwenye umiliki. | -| **Badilisha Ruhusa** | `p` | Badilisha ACLs kwenye faili au saraka. | +| **Read** | `r` | Soma yaliyomo ya faili. | +| **Write** | `w` | Pakia faili na tengeneza directories.| +| **List** | `l` | Orodhesha yaliyomo ndani ya directories. | +| **Delete** | `d` | Futa faili au directories. | +| **Create** | `c` | Unda faili au directories. | +| **Modify Ownership** | `o` | Badilisha mtumiaji mwenye miliki au group. | +| **Modify Permissions** | `p` | Badilisha ACLs kwenye faili au directories. | -## Enumeration +## Uorodheshaji {{#tabs }} {{#tab name="az cli" }}
-az cli uorodheshaji +az cli enumeration ```bash # Get storage accounts az storage account list #Get the account name from here @@ -420,25 +435,25 @@ New-AzStorageBlobSASToken ` {{#endtab }} {{#endtabs }} -### Kushiriki Faili +### Sehemu za Faili {{#ref}} az-file-shares.md {{#endref}} -## Kupandishwa kwa Vibali +## Privilege Escalation {{#ref}} ../az-privilege-escalation/az-storage-privesc.md {{#endref}} -## Baada ya Exploitation +## Post Exploitation {{#ref}} ../az-post-exploitation/az-blob-storage-post-exploitation.md {{#endref}} -## Uendelevu +## Persistence {{#ref}} ../az-persistence/az-storage-persistence.md @@ -449,6 +464,7 @@ az-file-shares.md - [https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction](https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blobs-introduction) - [https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview](https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview) - [https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support](https://learn.microsoft.com/en-us/azure/storage/blobs/secure-file-transfer-protocol-support) +- [Holiday Hack Challenge 2025 – Spare Key (Azure static website SAS leak)](https://0xdf.gitlab.io/holidayhack2025/act1/spare-key) - [Holiday Hack Challenge 2025: Blob Storage (Storage Secrets)](https://0xdf.gitlab.io/holidayhack2025/act1/blob-storage) - [https://learn.microsoft.com/en-us/cli/azure/storage/account](https://learn.microsoft.com/en-us/cli/azure/storage/account) - [https://learn.microsoft.com/en-us/cli/azure/storage/container](https://learn.microsoft.com/en-us/cli/azure/storage/container)