Add files via upload

2026-01-07 10:50:33 -08:00 · 2025-01-10 11:06:35 +01:00
parent 55fc400bf7
commit e8cee6743c
3 changed files with 277 additions and 0 deletions
--- a/src/pentesting-cloud/azure-security/az-privilege-escalation/az-postgresql-privesc.md
+++ b/src/pentesting-cloud/azure-security/az-privilege-escalation/az-postgresql-privesc.md
@@ -0,0 +1,93 @@
+# Az - PostgreSQL Privesc
+
+{% hint style="success" %}
+Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
+Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
+
+<details>
+
+<summary>Support HackTricks</summary>
+
+* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
+* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
+
+</details>
+{% endhint %}
+
+## PostgreSQL Privesc
+For more information about SQL Database check:
+
+{% content-ref url="../az-services/az-postgresql.md" %}
+[az-postgresql.md](../az-services/az-postgresql.md)
+{% endcontent-ref %}
+
+### "Microsoft.DBforPostgreSQL/flexibleServers/read" && "Microsoft.DBforPostgreSQL/flexibleServers/write"
+
+With this permission, you can create, update, or delete PostgreSQL Flexible Server instances on Azure. This includes provisioning new servers, modifying existing server configurations, or decommissioning servers.
+
+{% code overflow="wrap" %}
+```bash
+az postgres flexible-server create \
+    --name <ServerName> \
+    --resource-group <ResourceGroupName> \
+    --location <Location> \
+    --admin-user <AdminUsername> \
+    --admin-password <AdminPassword> \
+    --sku-name <SkuName> \
+    --storage-size <StorageSizeInGB> \
+    --tier <PricingTier> \
+    --version <PostgreSQLVersion>
+```
+{% endcode %}
+
+For example, this permissions allow changing the PostgreSQL password, usefull of course in case that PostgreSQL authentication is enabled.
+
+{% code overflow="wrap" %}
+```bash
+az postgres flexible-server update \
+    --resource-group <resource_group_name> \
+    --name <server_name> \
+    --admin-password <password_to_update>
+```
+{% endcode %}
+
+Additionally it is necesary to have the public access enabled if you want to access from a non private endpoint, to enable it:
+
+{% code overflow="wrap" %}
+```bash
+az postgres flexible-server update --resource-group <resource_group_name> --server-name <server_name> --public-access Enabled
+```
+{% endcode %}
+
+### "Microsoft.DBforPostgreSQL/flexibleServers/read", "Microsoft.DBforPostgreSQL/flexibleServers/write", "Microsoft.ManagedIdentity/userAssignedIdentities/assign/action", "Microsoft.DBforPostgreSQL/flexibleServers/administrators/write" && "Microsoft.DBforPostgreSQL/flexibleServers/administrators/read"
+
+With this permission, you can configure Azure Active Directory (AD) administrators for a PostgreSQL Flexible Server. This can be exploited by setting oneself or another account as the AD administrator, granting full administrative control over the PostgreSQL server. Updating existing principal is not supported yet so if there is one created you must delete it first.
+
+It's important that the flexible-server has a user assigned managed identities to use.
+
+{% code overflow="wrap" %}
+```bash
+az postgres flexible-server ad-admin create \
+    --resource-group <ResourceGroupName> \
+    --server-name <ServerName> \
+    --display-name <ADAdminDisplayName> \
+    --identity <IdentityNameOrID> \
+    --object-id <ObjectID>
+```
+{% endcode %}
+
+{% hint style="success" %}
+Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/image (1) (1) (1) (1).png" alt="" data-size="line">\
+Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/image (2) (1).png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
+
+<details>
+
+<summary>Support HackTricks</summary>
+
+* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
+* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks_live)**.**
+* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
+
+</details>
+{% endhint %}