Az - Blob Storage Post Exploitation

{% hint style="success" %} Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

Check the subscription plans!
Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

{% endhint %}

Storage Privesc

For more information about storage check:

{% content-ref url="../az-services/az-storage.md" %} az-storage.md {% endcontent-ref %}

Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read

A principal with this permission will be able to list the blobs (files) inside a container and download the files which might contain sensitive information.

# e.g. Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read
az storage blob list \
  --account-name <acc-name> \
  --container-name <container-name> --auth-mode login
  
az storage blob download \
  --account-name <acc-name> \
  --container-name <container-name> \
  -n file.txt --auth-mode login

Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write

A principal with this permission will be able to write and overwrite files in containers which might allow him to cause some damage or even escalate privileges (e.g. overwrite some code stored in a blob):

# e.g. Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write
az storage blob upload \
  --account-name <acc-name> \
  --container-name <container-name> \
  --file /tmp/up.txt --auth-mode login --overwrite

*/delete

This would allow to delete objects inside the storage account which might interrupt some services or make the client lose valuable information.