Az - App Services

Leer & oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Leer & oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Ondersteun HackTricks

Kyk na die subskripsie planne!
Sluit aan by die 💬 Discord groep of die telegram groep of volg ons op Twitter 🐦 @hacktricks_live.
Deel hacking truuks deur PRs in te dien na die HackTricks en HackTricks Cloud github repos.

App Service Basiese Inligting

Azure App Services stel ontwikkelaars in staat om webtoepassings, mobiele app agtergronde en API's naatloos te bou, te ontplooi en te skaal. Dit ondersteun verskeie programmeertale en integreer met verskeie Azure gereedskap en dienste vir verbeterde funksionaliteit en bestuur.

Elke app loop binne 'n sandbox, maar isolasie hang af van App Service planne

Apps in Gratis en Gedeelde vlakke loop op gedeelde VM's
Apps in Standaard en Premium vlakke loop op toegewyde VM's

Let daarop dat geen van daardie isolasies voorkom dat ander algemene web kwesbaarhede (soos lêeroplaai of inspuitings) voorkom nie. En as 'n bestuursidentiteit gebruik word, kan dit in staat wees om privileges na hulle te verhoog.

Azure Funksie Apps

Basies is Azure Funksie apps 'n substel van Azure App Service in die web en as jy na die webkonsol gaan en al die app dienste lys of az webapp list in az cli uitvoer, sal jy in staat wees om die Funksie apps ook hier gelys te sien.

Werklik, sommige van die veiligheidsverwante funksies wat App dienste gebruik (webapp in die az cli), word ook deur Funksie apps gebruik.

Basiese Verifikasie

Wanneer 'n web app (en 'n Azure funksie gewoonlik) geskep word, is dit moontlik om aan te dui of jy wil hê Basiese Verifikasie moet geaktiveer wees. Dit stel basies SCM en FTP vir die toepassing in, sodat dit moontlik sal wees om die toepassing met behulp van daardie tegnologieë te ontplooi. Boonop, om met hulle te verbind, bied Azure 'n API wat toelaat om die gebruikersnaam, wagwoord en URL te verkry om met die SCM en FTP bedieners te verbind.

Verifikasie: az webapp auth show --name lol --resource-group lol_group

SSH

Altijd Aan

Foutopsporing

Enumerasie

# List webapps
az webapp list

## Less information
az webapp list --query "[].{hostName: defaultHostName, state: state, name: name, resourcegroup: resourceGroup}"

# Get info about 1 app
az webapp show --name <name> --resource-group <res-group>

# Get instances of a webapp
az webapp list-instances --name <name> --resource-group <res-group>
## If you have enough perm you can go to the "consoleUrl" and access a shell inside the instance form the web

# Get configured Auth information
az webapp auth show --name <app-name> --resource-group <res-group>

# Get access restrictions of an app
az webapp config access-restriction show --name <name> --resource-group <res-group>

# Remove access restrictions
az webapp config access-restriction remove --resource-group <res-group> -n <name> --rule-name <rule-name>

# Get appsettings of an app
az webapp config appsettings list --name <name> --resource-group <res-group>

# Get backups of a webapp
az webapp config backup list --webapp-name <name> --resource-group <res-group>

# Get backups scheduled for a webapp
az webapp config backup show --webapp-name <name> --resource-group <res-group>

# Get snapshots
az webapp config snapshot list --resource-group <res-group> -n <name>

# Restore snapshot
az webapp config snapshot restore -g <res-group> -n <name> --time 2018-12-11T23:34:16.8388367

# Get connection strings of a webapp
az webapp config connection-string list --name <name> --resource-group <res-group>

# Get used container by the app
az webapp config container show --name <name> --resource-group <res-group>

# Get storage account configurations of a webapp
az webapp config storage-account list --name <name> --resource-gl_group








# List all the functions
az functionapp list

# Get info of 1 funciton (although in the list you already get this info)
az functionapp show --name <app-name> --resource-group <res-group>
## If "linuxFxVersion" has something like: "DOCKER|mcr.microsoft.com/..."
## This is using a container

# Get details about the source of the function code
az functionapp deployment source show \
--name <app-name> \
--resource-group <res-group>
## If error like "This is currently not supported."
## Then, this is probalby using a container

# Get more info if a container is being used
az functionapp config container show \
--name <name> \
--resource-group <res-group>

# Get settings (and privesc to the sorage account)
az functionapp config appsettings list --name <app-name> --resource-group <res-group>

# Check if a domain was assigned to a function app
az functionapp config hostname list --webapp-name <app-name> --resource-group <res-group>

# Get SSL certificates
az functionapp config ssl list --resource-group <res-group>

# Get network restrictions
az functionapp config access-restriction show --name <app-name> --resource-group <res-group>

# Get more info about a function (invoke_url_template is the URL to invoke and script_href allows to see the code)
az rest --method GET \
--url "https://management.azure.com/subscriptions/<subscription>/resourceGroups/<res-group>/providers/Microsoft.Web/sites/<app-name>/functions?api-version=2024-04-01"

# Get source code with Master Key of the function
curl "<script_href>?code=<master-key>"
## Python example
curl "https://newfuncttest123.azurewebsites.net/admin/vfs/home/site/wwwroot/function_app.py?code=<master-key>" -v

# Get source code
az rest --url "https://management.azure.com/<subscription>/resourceGroups/<res-group>/providers/Microsoft.Web/sites/<app-name>/hostruntime/admin/vfs/function_app.py?relativePath=1&api-version=2022-03-01"

# Get App Services and Function Apps
Get-AzWebApp
# Get only App Services
Get-AzWebApp | ?{$_.Kind -notmatch "functionapp"}

#!/bin/bash

# Get all App Service and Function Apps

# Define Azure subscription ID
azure_subscription="your_subscription_id"

# Log in to Azure
az login

# Select Azure subscription
az account set --subscription $azure_subscription

# Get all App Services in the specified subscription
list_app_services=$(az appservice list --query "[].{appServiceName: name, group: resourceGroup}" -o tsv)

# Iterate over each App Service
echo "$list_app_services" | while IFS=$'\t' read -r appServiceName group; do
# Get the type of the App Service
service_type=$(az appservice show --name $appServiceName --resource-group $group --query "kind" -o tsv)

# Check if it is a Function App and print its name
if [ "$service_type" == "functionapp" ]; then
echo "Function App Name: $appServiceName"
fi
done

Verkry geloofsbriewe & kry toegang tot die webapp-kode

# Get connection strings that could contain credentials (with DBs for example)
az webapp config connection-string list --name <name> --resource-group <res-group>
## Check how to use the DBs connection strings in the SQL page

# Get credentials to access the code and DB credentials if configured.
az webapp deployment list-publishing-profiles --resource-group <res-group> -n <name>


# Get git URL to access the code
az webapp deployment source config-local-git --resource-group <res-group> -n <name>

# Access/Modify the code via git
git clone 'https://<username>:<password>@name.scm.azurewebsites.net/repo-name.git'
## In my case the username was: $nameofthewebapp and the password some random chars
## If you change the code and do a push, the app is automatically redeployed

Privilege Escalation

Verwysings

https://learn.microsoft.com/en-in/azure/app-service/overview

Ondersteun HackTricks

Kyk na die subskripsie planne!
Sluit aan by die 💬 Discord groep of die telegram groep of volg ons op Twitter 🐦 @hacktricks_live.
Deel hacking truuks deur PRs in te dien na die HackTricks en HackTricks Cloud github repos.

PreviousAz - State Configuration RCE NextAz - Intune

Last updated 18 hours ago