Az - App Services

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

App Service Basic Information

Azure App Services consente agli sviluppatori di creare, distribuire e scalare applicazioni web, backend di app mobili e API senza soluzione di continuità. Supporta più linguaggi di programmazione e si integra con vari strumenti e servizi Azure per funzionalità e gestione avanzate.

Ogni app viene eseguita all'interno di un sandbox, ma l'isolamento dipende dai piani App Service

• Le app nei livelli Free e Shared vengono eseguite su VM condivise

• Le app nei livelli Standard e Premium vengono eseguite su VM dedicate

Nota che nessuno di questi isolamenti previene altre comuni vulnerabilità web (come il caricamento di file o le iniezioni). E se viene utilizzata un'identità di gestione, potrebbe essere in grado di escalare i privilegi su di esse.

Azure Function Apps

Fondamentalmente le Azure Function apps sono un sottoinsieme di Azure App Service nel web e se vai alla console web e elenchi tutti i servizi app o esegui az webapp list in az cli, sarai in grado di vedere anche le Function apps elencate qui.

In realtà alcune delle funzionalità relative alla sicurezza che i servizi app utilizzano (webapp nell'az cli) sono anche utilizzate dalle Function apps.

Basic Authentication

Quando si crea un'app web (e una funzione Azure di solito) è possibile indicare se si desidera abilitare l'autenticazione di base. Questo sostanzialmente abilita SCM e FTP per l'applicazione, quindi sarà possibile distribuire l'applicazione utilizzando queste tecnologie. Inoltre, per connettersi a esse, Azure fornisce un'API che consente di ottenere il nome utente, la password e l'URL per connettersi ai server SCM e FTP.

• Autenticazione: az webapp auth show --name lol --resource-group lol_group

SSH

Always On

Debugging

Enumeration

az

# List webapps
az webapp list

## Less information
az webapp list --query "[].{hostName: defaultHostName, state: state, name: name, resourcegroup: resourceGroup}"

# Get info about 1 app
az webapp show --name <name> --resource-group <res-group>

# Get instances of a webapp
az webapp list-instances --name <name> --resource-group <res-group>
## If you have enough perm you can go to the "consoleUrl" and access a shell inside the instance form the web

# Get configured Auth information
az webapp auth show --name <app-name> --resource-group <res-group>

# Get access restrictions of an app
az webapp config access-restriction show --name <name> --resource-group <res-group>

# Remove access restrictions
az webapp config access-restriction remove --resource-group <res-group> -n <name> --rule-name <rule-name>

# Get appsettings of an app
az webapp config appsettings list --name <name> --resource-group <res-group>

# Get backups of a webapp
az webapp config backup list --webapp-name <name> --resource-group <res-group>

# Get backups scheduled for a webapp
az webapp config backup show --webapp-name <name> --resource-group <res-group>

# Get snapshots
az webapp config snapshot list --resource-group <res-group> -n <name>

# Restore snapshot
az webapp config snapshot restore -g <res-group> -n <name> --time 2018-12-11T23:34:16.8388367

# Get connection strings of a webapp
az webapp config connection-string list --name <name> --resource-group <res-group>

# Get used container by the app
az webapp config container show --name <name> --resource-group <res-group>

# Get storage account configurations of a webapp
az webapp config storage-account list --name <name> --resource-gl_group








# List all the functions
az functionapp list

# Get info of 1 funciton (although in the list you already get this info)
az functionapp show --name <app-name> --resource-group <res-group>
## If "linuxFxVersion" has something like: "DOCKER|mcr.microsoft.com/..."
## This is using a container

# Get details about the source of the function code
az functionapp deployment source show \
--name <app-name> \
--resource-group <res-group>
## If error like "This is currently not supported."
## Then, this is probalby using a container

# Get more info if a container is being used
az functionapp config container show \
--name <name> \
--resource-group <res-group>

# Get settings (and privesc to the sorage account)
az functionapp config appsettings list --name <app-name> --resource-group <res-group>

# Check if a domain was assigned to a function app
az functionapp config hostname list --webapp-name <app-name> --resource-group <res-group>

# Get SSL certificates
az functionapp config ssl list --resource-group <res-group>

# Get network restrictions
az functionapp config access-restriction show --name <app-name> --resource-group <res-group>

# Get more info about a function (invoke_url_template is the URL to invoke and script_href allows to see the code)
az rest --method GET \
--url "https://management.azure.com/subscriptions/<subscription>/resourceGroups/<res-group>/providers/Microsoft.Web/sites/<app-name>/functions?api-version=2024-04-01"

# Get source code with Master Key of the function
curl "<script_href>?code=<master-key>"
## Python example
curl "https://newfuncttest123.azurewebsites.net/admin/vfs/home/site/wwwroot/function_app.py?code=<master-key>" -v

# Get source code
az rest --url "https://management.azure.com/<subscription>/resourceGroups/<res-group>/providers/Microsoft.Web/sites/<app-name>/hostruntime/admin/vfs/function_app.py?relativePath=1&api-version=2022-03-01"

Az Powershell

# Get App Services and Function Apps
Get-AzWebApp
# Get only App Services
Get-AzWebApp | ?{$_.Kind -notmatch "functionapp"}

az get all

#!/bin/bash

# Get all App Service and Function Apps

# Define Azure subscription ID
azure_subscription="your_subscription_id"

# Log in to Azure
az login

# Select Azure subscription
az account set --subscription $azure_subscription

# Get all App Services in the specified subscription
list_app_services=$(az appservice list --query "[].{appServiceName: name, group: resourceGroup}" -o tsv)

# Iterate over each App Service
echo "$list_app_services" | while IFS=$'\t' read -r appServiceName group; do
# Get the type of the App Service
service_type=$(az appservice show --name $appServiceName --resource-group $group --query "kind" -o tsv)

# Check if it is a Function App and print its name
if [ "$service_type" == "functionapp" ]; then
echo "Function App Name: $appServiceName"
fi
done

Ottenere credenziali e accedere al codice dell'app web

# Get connection strings that could contain credentials (with DBs for example)
az webapp config connection-string list --name <name> --resource-group <res-group>
## Check how to use the DBs connection strings in the SQL page

# Get credentials to access the code and DB credentials if configured.
az webapp deployment list-publishing-profiles --resource-group <res-group> -n <name>


# Get git URL to access the code
az webapp deployment source config-local-git --resource-group <res-group> -n <name>

# Access/Modify the code via git
git clone 'https://<username>:<password>@name.scm.azurewebsites.net/repo-name.git'
## In my case the username was: $nameofthewebapp and the password some random chars
## If you change the code and do a push, the app is automatically redeployed

Elevazione dei privilegi

Az - App Services Privesc

Riferimenti

• https://learn.microsoft.com/en-in/azure/app-service/overview

Impara e pratica il hacking AWS:HackTricks Training AWS Red Team Expert (ARTE) Impara e pratica il hacking GCP: HackTricks Training GCP Red Team Expert (GRTE)

Supporta HackTricks

• Controlla i piani di abbonamento!

• Unisciti al 💬 gruppo Discord o al gruppo telegram o seguici su Twitter 🐦 @hacktricks_live.

• Condividi trucchi di hacking inviando PR ai HackTricks e HackTricks Cloud repos di github.