Az - App Services

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

App Service Basic Information

Azure App Services는 개발자가 웹 애플리케이션, 모바일 앱 백엔드 및 API를 원활하게 구축, 배포 및 확장할 수 있도록 합니다. 여러 프로그래밍 언어를 지원하며, 향상된 기능과 관리를 위해 다양한 Azure 도구 및 서비스와 통합됩니다.

각 앱은 샌드박스 내에서 실행되지만 격리는 App Service 계획에 따라 다릅니다.

• 무료 및 공유 계층의 앱은 공유 VM에서 실행됩니다.

• 표준 및 프리미엄 계층의 앱은 전용 VM에서 실행됩니다.

이러한 격리는 파일 업로드나 주입과 같은 다른 일반적인 웹 취약점을 방지하지 않습니다. 그리고 관리 ID가 사용되는 경우, 권한을 상승시킬 수 있습니다.

Azure Function Apps

기본적으로 Azure Function 앱은 Azure App Service의 하위 집합이며, 웹 콘솔로 이동하여 모든 앱 서비스를 나열하거나 az cli에서 az webapp list를 실행하면 여기에도 Function 앱이 나열된 것을 볼 수 있습니다.

실제로 App 서비스가 사용하는 일부 보안 관련 기능(webapp in az cli)은 Function 앱에서도 사용됩니다.

Basic Authentication

웹 앱(및 일반적으로 Azure 함수)을 생성할 때 기본 인증을 활성화할지 여부를 지정할 수 있습니다. 이는 기본적으로 SCM 및 FTP를 애플리케이션에 대해 활성화하여 이러한 기술을 사용하여 애플리케이션을 배포할 수 있게 합니다. 또한 이들에 연결하기 위해 Azure는 SCM 및 FTP 서버에 연결하기 위한 사용자 이름, 비밀번호 및 URL을 가져오는 API를 제공합니다.

• 인증: az webapp auth show --name lol --resource-group lol_group

SSH

Always On

Debugging

Enumeration

az

# List webapps
az webapp list

## Less information
az webapp list --query "[].{hostName: defaultHostName, state: state, name: name, resourcegroup: resourceGroup}"

# Get info about 1 app
az webapp show --name <name> --resource-group <res-group>

# Get instances of a webapp
az webapp list-instances --name <name> --resource-group <res-group>
## If you have enough perm you can go to the "consoleUrl" and access a shell inside the instance form the web

# Get configured Auth information
az webapp auth show --name <app-name> --resource-group <res-group>

# Get access restrictions of an app
az webapp config access-restriction show --name <name> --resource-group <res-group>

# Remove access restrictions
az webapp config access-restriction remove --resource-group <res-group> -n <name> --rule-name <rule-name>

# Get appsettings of an app
az webapp config appsettings list --name <name> --resource-group <res-group>

# Get backups of a webapp
az webapp config backup list --webapp-name <name> --resource-group <res-group>

# Get backups scheduled for a webapp
az webapp config backup show --webapp-name <name> --resource-group <res-group>

# Get snapshots
az webapp config snapshot list --resource-group <res-group> -n <name>

# Restore snapshot
az webapp config snapshot restore -g <res-group> -n <name> --time 2018-12-11T23:34:16.8388367

# Get connection strings of a webapp
az webapp config connection-string list --name <name> --resource-group <res-group>

# Get used container by the app
az webapp config container show --name <name> --resource-group <res-group>

# Get storage account configurations of a webapp
az webapp config storage-account list --name <name> --resource-gl_group








# List all the functions
az functionapp list

# Get info of 1 funciton (although in the list you already get this info)
az functionapp show --name <app-name> --resource-group <res-group>
## If "linuxFxVersion" has something like: "DOCKER|mcr.microsoft.com/..."
## This is using a container

# Get details about the source of the function code
az functionapp deployment source show \
--name <app-name> \
--resource-group <res-group>
## If error like "This is currently not supported."
## Then, this is probalby using a container

# Get more info if a container is being used
az functionapp config container show \
--name <name> \
--resource-group <res-group>

# Get settings (and privesc to the sorage account)
az functionapp config appsettings list --name <app-name> --resource-group <res-group>

# Check if a domain was assigned to a function app
az functionapp config hostname list --webapp-name <app-name> --resource-group <res-group>

# Get SSL certificates
az functionapp config ssl list --resource-group <res-group>

# Get network restrictions
az functionapp config access-restriction show --name <app-name> --resource-group <res-group>

# Get more info about a function (invoke_url_template is the URL to invoke and script_href allows to see the code)
az rest --method GET \
--url "https://management.azure.com/subscriptions/<subscription>/resourceGroups/<res-group>/providers/Microsoft.Web/sites/<app-name>/functions?api-version=2024-04-01"

# Get source code with Master Key of the function
curl "<script_href>?code=<master-key>"
## Python example
curl "https://newfuncttest123.azurewebsites.net/admin/vfs/home/site/wwwroot/function_app.py?code=<master-key>" -v

# Get source code
az rest --url "https://management.azure.com/<subscription>/resourceGroups/<res-group>/providers/Microsoft.Web/sites/<app-name>/hostruntime/admin/vfs/function_app.py?relativePath=1&api-version=2022-03-01"

Az Powershell

az 파워셸

# Get App Services and Function Apps
Get-AzWebApp
# Get only App Services
Get-AzWebApp | ?{$_.Kind -notmatch "functionapp"}

az get all

#!/bin/bash

# Get all App Service and Function Apps

# Define Azure subscription ID
azure_subscription="your_subscription_id"

# Log in to Azure
az login

# Select Azure subscription
az account set --subscription $azure_subscription

# Get all App Services in the specified subscription
list_app_services=$(az appservice list --query "[].{appServiceName: name, group: resourceGroup}" -o tsv)

# Iterate over each App Service
echo "$list_app_services" | while IFS=$'\t' read -r appServiceName group; do
# Get the type of the App Service
service_type=$(az appservice show --name $appServiceName --resource-group $group --query "kind" -o tsv)

# Check if it is a Function App and print its name
if [ "$service_type" == "functionapp" ]; then
echo "Function App Name: $appServiceName"
fi
done

자격 증명 얻기 및 웹앱 코드에 접근하기

# Get connection strings that could contain credentials (with DBs for example)
az webapp config connection-string list --name <name> --resource-group <res-group>
## Check how to use the DBs connection strings in the SQL page

# Get credentials to access the code and DB credentials if configured.
az webapp deployment list-publishing-profiles --resource-group <res-group> -n <name>


# Get git URL to access the code
az webapp deployment source config-local-git --resource-group <res-group> -n <name>

# Access/Modify the code via git
git clone 'https://<username>:<password>@name.scm.azurewebsites.net/repo-name.git'
## In my case the username was: $nameofthewebapp and the password some random chars
## If you change the code and do a push, the app is automatically redeployed

권한 상승

Az - App Services Privesc

참고자료

• https://learn.microsoft.com/en-in/azure/app-service/overview

AWS 해킹 배우기 및 연습하기:HackTricks Training AWS Red Team Expert (ARTE) GCP 해킹 배우기 및 연습하기: HackTricks Training GCP Red Team Expert (GRTE)

HackTricks 지원하기

• 구독 계획 확인하기!

• **💬 Discord 그룹 또는 텔레그램 그룹에 참여하거나 Twitter 🐦 @hacktricks_live를 팔로우하세요.

• HackTricks 및 HackTricks Cloud 깃허브 리포지토리에 PR을 제출하여 해킹 팁을 공유하세요.