gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-07-28 14:47:17 -07:00
Code Issues Packages Projects Releases Wiki Activity
1,039 Commits 22 Branches 17 Tags
9153166a1d15fd64c7a324376faa579c39c76d0d
Commit Graph
1039 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
OffsecPierogiandGitHub 9153166a1d Update az-automation-accounts-privesc.md 
The 2 following techniques demonstrate how privilege escalation can be done with modules and python packages in Azure involving automation accounts. Original research with screenshots and evidence can be provided upon request.
 2026-06-25 09:44:28 -04:00
SirBroccoliandGitHub 42e19b55ad Merge pull request #315 from HackTricks-wiki/refine-hovered-sponsor-layout-20260624173941 
Refine hovered sponsor layout
 2026-06-24 17:57:50 +02:00
Carlos Polop da81c92add Adjust sponsor ad layout 2026-06-24 17:56:26 +02:00
Hermes d529a9e36d Refine hovered sponsor layout 2026-06-24 17:39:41 +02:00
SirBroccoliandGitHub 8e4b5d5693 Merge pull request #314 from HackTricks-wiki/fix-sponsor-title-visibility-20260624171228 
Fix sponsor title visibility
 2026-06-24 17:24:42 +02:00
Hermes fbbe2cbad8 Improve sponsor title visibility 2026-06-24 17:12:28 +02:00
SirBroccoliandGitHub 221643d353 Merge pull request #313 from HackTricks-wiki/add-linux-course-sponsor-images-20260624163124 
Add Linux course sponsor images
 2026-06-24 16:33:57 +02:00
Hermes 6bec7f4e0a Add Linux course sponsor images 2026-06-24 16:31:25 +02:00
SirBroccoliandGitHub 901f745d5a Merge pull request #309 from HackTricks-wiki/hermes/reduce-cloudfront-invalidation-paths 
Reduce redundant CloudFront invalidation paths
 2026-06-21 15:52:05 +02:00
SirBroccoliandGitHub db20d27796 Merge pull request #310 from TheToddLuci0/azure_alert_phishing 
azrte-TheToddLuci0
 2026-06-21 15:51:41 +02:00
Hermes Agent 50de879350 Reduce redundant CloudFront invalidation paths 2026-06-19 08:37:23 +02:00
SirBroccoliandGitHub 6a99acfb6f Merge pull request #306 from HackTricks-wiki/update_Hacking_Google_with_AI_AI-Assisted_Discovery-Doc_f250207268e52efb 
Hacking Google with AI AI-Assisted Discovery-Document Fuzzin...
 2026-06-16 15:37:49 +02:00
SirBroccoliandGitHub a11e2ff62a Merge pull request #304 from HackTricks-wiki/update_Ghost-Sender_-_Universal_Email_Spoofing_against__8fb2d618657690cb 
Ghost-Sender - Universal Email Spoofing against Exchange Onl...
 2026-06-16 15:26:37 +02:00
SirBroccoliandGitHub 7a707977b1 Merge pull request #308 from marcgoam/azrte-marcgoam 
azrte-marcgoam
 2026-06-16 15:20:23 +02:00
SirBroccoliandGitHub d318847a36 Merge pull request #305 from Fudgedotdotdot/master 
azrte-Fudgedotdotdot
 2026-06-16 15:13:09 +02:00
Marc Gonzalez AmoresandGitHub f2f340de83 Add applications.myOrganization/allProperties/update privesc technique 
## Summary

Adds a new privilege escalation technique to the EntraID privesc page, covering `microsoft.directory/applications.myOrganization/allProperties/update`.

This permission is not present in any built-in role but commonly appears in custom roles delegated to application teams under the assumption that the `.myOrganization` subtype scopes the action to internal-only apps. Since `allProperties` includes `passwordCredentials` and `keyCredentials`, the permission is functionally equivalent to credential-injection capability against every single-tenant app in the tenant.

## Why this matters

The existing page already documents `applications/credentials/update`. The new section complements it by surfacing the custom-role-scoped variant, which is underdocumented and easy to miss during privileged-role audits, admins filter on built-in privileged roles and miss custom roles carrying this single action.

## Testing

The full attack chain was reproduced end-to-end in an isolated Microsoft 365 Business Premium trial tenant:

      1. Created a custom role with `applications.myOrganization/allProperties/update` as the only action.
      2. Assigned it to a non-privileged victim user.
      3. From the victim's session, ran the documented commands to inject a credential into a target single-tenant app and successfully authenticated as the application via `az login --service-principal`.

## References

  - https://learn.microsoft.com/entra/identity/role-based-access-control/custom-available-permissions
  - https://learn.microsoft.com/entra/identity/role-based-access-control/permissions-reference
  - https://learn.microsoft.com/graph/api/application-addpassword
 2026-06-12 11:02:33 +02:00
HackTricks News Bot 108413b913 Add content from: Hacking Google with AI: AI-Assisted Discovery-Document Fuzzi... 2026-06-11 16:13:40 +00:00
Fudgedotdotdot 7e4c12b7ff Clarified Microsoft.Web/sites/publishxml/action , Microsoft.Web/sites/basicPublishingCredentialsPolicies/write for functionapps 2026-06-10 14:33:48 +02:00
HackTricks News Bot 94cb3da491 Add content from: Ghost-Sender - Universal Email Spoofing against Exchange Onl... 2026-06-10 03:40:02 +00:00
SirBroccoliandGitHub b81257def6 Merge pull request #301 from HackTricks-wiki/update_Poisoning_Claude_Code__One_GitHub_Issue_to_Break_t_20260602_103342 
Poisoning Claude Code One GitHub Issue to Break the Supply C...
 2026-06-05 16:11:29 +02:00
SirBroccoliandGitHub 680428f929 Merge pull request #299 from HackTricks-wiki/update_Authenticated_RCE_via_Argument_Injection_in_Gogs_R_20260528_154851 
Authenticated RCE via Argument Injection in Gogs Rebase Merg...
 2026-06-05 15:52:53 +02:00
SirBroccoliandGitHub ab22b74079 Merge pull request #298 from cblopez/patch-1 
Added access entry abuse to pivot from AWS to Kubernetes
 2026-06-05 15:51:47 +02:00
SirBroccoliandGitHub 45e53868a6 Merge pull request #297 from HackTricks-wiki/update_Investigating_Suspicious_AI_Workflows_in_Microsoft_20260527_153712 
Investigating Suspicious AI Workflows in Microsoft Entra Age...
 2026-06-05 11:23:54 +02:00
SirBroccoliandGitHub f509732e5d Merge pull request #296 from JaimePolop/master 
Fix table
 2026-06-05 11:22:07 +02:00
Carlos Polop 8867d2f8c0 f 2026-06-05 10:40:57 +02:00
SirBroccoliandGitHub ec2bf385fe Merge pull request #302 from HackTricks-wiki/fix/hermes-root-sitemap-invalidation 
ci: skip unchanged root sitemap invalidations
 2026-06-04 23:56:41 +02:00
Hermes 4c4632303a ci: skip unchanged root sitemap invalidations 2026-06-04 08:23:45 +02:00
HackTricks News Bot 667a8b921e Add content from: Poisoning Claude Code: One GitHub Issue to Break the Supply ... 2026-06-02 10:37:40 +00:00
HackTricks News Bot 4317b90953 Add content from: Authenticated RCE via Argument Injection in Gogs Rebase Merg... 2026-05-28 15:52:25 +00:00
Christian BarralandGitHub 97af0f5005 Added access entry abuse info 
Added sections on abusing configmap (existing) and access entries (new) for AWS EKS, including commands for creating access entries and associating access policies.
 2026-05-28 09:06:51 +02:00
HackTricks News Bot f6523f3643 Add content from: Investigating Suspicious AI Workflows in Microsoft Entra Age... 2026-05-27 15:41:56 +00:00
Jimmy 769ae53c76 Fix table 2026-05-27 00:26:48 +02:00
SirBroccoliandGitHub 2aea30dad8 Merge pull request #295 from HackTricks-wiki/teamcity-security-section 
Add TeamCity CI/CD pentesting section
 2026-05-26 21:32:53 +02:00
Carlos Polop e9b5f23f8a Add TeamCity CI/CD pentesting section 2026-05-26 21:31:37 +02:00
SirBroccoliandGitHub 23530050c5 Merge pull request #293 from HackTricks-wiki/update_Navigating_Lax_Load_Balancers__When_an_Intersectio_20260525_145126 
Navigating Lax Load Balancers When an Intersection Gets You ...
 2026-05-26 21:11:31 +02:00
SirBroccoliandGitHub af48369ba7 Merge pull request #292 from HackTricks-wiki/update_Paved_With_Intent__ROADtools_and_Nation-State_Tact_20260522_143732 
Paved With Intent ROADtools and Nation-State Tactics in the ...
 2026-05-26 21:09:38 +02:00
SirBroccoliandGitHub ae1056fe51 Merge pull request #290 from HackTricks-wiki/update_Mini_Shai-Hulud__FAQ_on_the_TeamPCP_npm_and_PyPI_s_20260521_195353 
Mini Shai-Hulud FAQ on the TeamPCP npm and PyPI supply-chain...
 2026-05-26 21:04:47 +02:00
SirBroccoliandGitHub b4424204e9 Update README.md 2026-05-26 21:04:31 +02:00
SirBroccoliandGitHub 5400f7c96a Merge pull request #288 from HackTricks-wiki/chore/drop-redundant-robots-invalidation-20260519 
Avoid redundant robots CloudFront invalidations
 2026-05-26 21:00:53 +02:00
SirBroccoliandGitHub 2439b0354b Merge pull request #294 from Jacob-Ham/aws-fix-iam-mfa 
Fixed some IAM MFA device priv esc issues.
 2026-05-26 20:06:25 +02:00
Jacob-Ham 3963a1ef8a Fixed virtual mfa device creation command, add example TOTP tool, add command for getting mfa backed session 2026-05-26 12:54:52 -05:00
Carlos Polop 06a089227c f 2026-05-26 17:55:54 +02:00
HackTricks News Bot aa93024621 Add content from: Navigating Lax Load Balancers: When an Intersection Gets You... 2026-05-25 14:55:45 +00:00
HackTricks News Bot 28650f17b4 Add content from: Paved With Intent: ROADtools and Nation-State Tactics in the... 2026-05-22 14:43:02 +00:00
HackTricks News Bot 5704b992d8 Add content from: Red-Teaming Cloud Infrastructure with Neo 2026-05-22 09:06:12 +00:00
HackTricks News Bot 1484d713ec Add content from: Mini Shai-Hulud: FAQ on the TeamPCP npm and PyPI supply-chai... 2026-05-21 19:57:44 +00:00
Hermes 4ae4b59345 Avoid redundant robots CloudFront invalidations 2026-05-19 08:16:18 +02:00
Carlos Polop 8cb43f6b52 Keep sponsor title visible on hover 2026-05-18 21:36:03 +02:00
Carlos Polop 4345b0e6bb Refine sponsor hover and update CTA styling 2026-05-18 21:10:45 +02:00
Carlos Polop c1bd048854 Add page update request nav link 2026-05-18 21:03:00 +02:00