From f3453697ad8fa75bfc96811cd6b3e00191ac69bc Mon Sep 17 00:00:00 2001 From: Translator Date: Tue, 25 Feb 2025 22:31:04 +0000 Subject: [PATCH] Translated ['src/pentesting-cloud/azure-security/az-services/az-containe --- .../az-container-instances-apps-jobs.md | 116 ++++++++++++++++++ 1 file changed, 116 insertions(+) create mode 100644 src/pentesting-cloud/azure-security/az-services/az-container-instances-apps-jobs.md diff --git a/src/pentesting-cloud/azure-security/az-services/az-container-instances-apps-jobs.md b/src/pentesting-cloud/azure-security/az-services/az-container-instances-apps-jobs.md new file mode 100644 index 000000000..7c102755e --- /dev/null +++ b/src/pentesting-cloud/azure-security/az-services/az-container-instances-apps-jobs.md @@ -0,0 +1,116 @@ +# Az - Container Instances + +{{#include ../../../banners/hacktricks-training.md}} + +## Basic Information + +**Azure Container Instances (ACI)** ni huduma ya kontena isiyo na seva inayokuwezesha kuendesha kontena binafsi haraka bila kusimamia miundombinu yoyote ya msingi. **Azure Container Apps (ACA)** inapanua hii kwa kutoa mazingira yaliyosimamiwa kikamilifu kwa kuendesha microservices na programu za wavuti zenye vipengele kama vile autoscaling inayotokana na matukio, ujumuishaji wa Dapr uliojengwa ndani, na msaada kwa hali ngumu za uratibu. **Container App Jobs** ni kipengele maalum ndani ya ACA kilichoundwa kwa ajili ya kuendesha kazi za muda mfupi, kundi, au zilizopangwa ambazo zinafanyika kwa muda fulani kisha kuondoka. + +Tofauti: +- ACI ni bora kwa **kazi rahisi**, za pekee za kontena ambapo uratibu mdogo unahitajika. +- ACA inafaa zaidi kwa kujenga microservices zinazoweza kupanuka, zilizounganishwa zenye vipengele vya juu kama autoscaling na ugunduzi wa huduma. +- Container App Jobs zinazingatia **kazi za mara moja au zilizopangwa**, zikitoa njia rahisi ya kuendesha kazi za nyuma au kundi ndani ya mazingira ya ACA. + +### Configurations + +Chaguzi maalum za **ACI**: +- Kuhusu mtandao, inawezekana kuchagua moja ya chaguzi hizi 3: +- **Public** (chaguo la kawaida) +- **Private** (inapatikana tu kutoka VNet) +- **None** (hakuna ufikiaji wa mtandao) + +Chaguzi maalum za **ACA**: +- Inawezekana **kuzuia trafiki** kwa kontena kwa mazingira ya programu ya kontena au kuacha kuwa hadharani. +- Inawezekana kutumia **mtoa kitambulisho wa nje** (Microsoft, Facebook, Google, na Twitter) kwa ajili ya uthibitishaji. +- Inawezekana **kuhifadhi siri za programu** (katika maandiko wazi ya programu au kama viungo kwa vault ikitenga MI yenye ufikiaji juu yake). +- Inawezekana kuwa na **mabadiliko na nakala za programu**. +- Inawezekana kupeleka kutoka **kanuni maalum au kipande** badala ya kutumia kontena. Kwa ajili ya kanuni, ufikiaji wa Gihub lazima utolewe. Kwa ajili ya vipande, inawezekana kupakia baada ya kuunda programu. + +Chaguzi maalum za **jobs**: +- Aina ya trigger inaweza kuwa **ya mkono, iliyopangwa au inayotokana na tukio** (kama ujumbe kufika kwenye foleni). + +Chaguzi za kawaida: +- Ili kuunda kontena, inawezekana kutumia picha ya umma, picha ya kontena kutoka kwenye Azure Container Registry au hifadhi ya nje, ambayo inaweza **kuhitaji kusanidi nenosiri** ili kuipata. +- Hii ina maana kwamba usanidi wa kontena unaweza kuwa na taarifa nyeti. +- Pia inawezekana kusanidi mipangilio ya kawaida ya docker kama: +- **Mabadiliko ya mazingira** (angalia taarifa nyeti) +- **Volumes** (hata kutoka Azure Files) +- **Ports** za kufichua +- **Mipaka ya CPU na kumbukumbu** +- **Sera ya kurejesha** +- **Kukimbia kama mwenye mamlaka** +- Badilisha **amri za kontena na hoja** (zinaweza kubadilishwa katika kontena zilizopo pia) +- ... + +## Enumeration + +> [!WARNING] +> Wakati wa kuhesabu, unaweza kufichua usanidi nyeti kama vile **mabadiliko ya mazingira**, **maelezo ya mtandao**, au **identities zinazodhibitiwa**. +```bash +# ACI +## List all container instances in the subscription +az container list + +## Show detailed information about a specific container instance +az container show --name --resource-group + +## Fetch logs from a container +az container logs --name --resource-group + +## Execute a command in a running container and get the output +az container exec --name --resource-group --exec-command "/bin/sh" # Get a shell + +## Get yaml configuration of the container group +az container export --name --resource-group --file + +# ACA +## List all container apps in the subscription +az containerapp list + +## Show detailed information about a specific container app +az containerapp show --name --resource-group + +## List app environments +az containerapp env list --resource-group + +## Fetch logs from a container app +az containerapp logs show --name --resource-group + +## Get configured secrets +az containerapp secret list --name --resource-group +### Get value +az containerapp secret show --name --resource-group --secret-name + +## Get authentication options +az containerapp auth show --name --resource-group + +## Get a shell +az containerapp exec --name --resource-group --command "sh" + +## Get debugging shell +az containerapp debug --name --resource-group + +# Jobs +## List all container apps jobs in a resource group +az containerapp job list --resource-group + +## Show detailed information about a specific container app job +az containerapp job show --name --resource-group + +## Fetch logs from a container app job +az containerapp job logs show --name --resource-group + +## Fetch executions from a container app job +az containerapp job execution list --name --resource-group +az containerapp job execution show --name --resource-group --job-execution-name + +## Start a job execution (for manual jobs) +az containerapp job start --name --resource-group +``` +## Kuinua Mamlaka & Baada ya Kutekeleza + +{{#ref}} +../az-privilege-escalation/az-container-instances-apps-jobs-privesc.md +{{#endref}} + +{{#include ../../../banners/hacktricks-training.md}}