Az - Table Storage Post Exploitation

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Table Storage Privesc

For more information about table storage check:

Az - Table Storage

Microsoft.Storage/storageAccounts/tableServices/tables/entities/read

A principal with this permission will be able to list the tables inside a table storage and read the info which might contain sensitive information.

# List tables
az storage table list --auth-mode login --account-name <name>

# Read table (top 10)
az storage entity query \
    --account-name <name> \
    --table-name <t-name> \
    --auth-mode login \
    --top 10

Microsoft.Storage/storageAccounts/tableServices/tables/entities/write | Microsoft.Storage/storageAccounts/tableServices/tables/entities/add/action | Microsoft.Storage/storageAccounts/tableServices/tables/entities/update/action

A principal with this permission will be able to write and overwrite entries in tables which might allow him to cause some damage or even escalate privileges (e.g. overwrite some trusted data that could abuse some injection vulnerability in the app using it).

• The permission Microsoft.Storage/storageAccounts/tableServices/tables/entities/write allows all the actions.

• The permission Microsoft.Storage/storageAccounts/tableServices/tables/entities/add/action allows to add entries

• The permission Microsoft.Storage/storageAccounts/tableServices/tables/entities/update/action allows to update existing entries

# Add
az storage entity insert \
  --account-name <acc-name> \
  --table-name <t-name> \
  --auth-mode login \
  --entity PartitionKey=HR RowKey=12345 Name="John Doe" Age=30 Title="Manager"

# Replace
az storage entity replace \
  --account-name <acc-name> \
  --table-name <t-name> \
  --auth-mode login \
  --entity PartitionKey=HR RowKey=12345 Name="John Doe" Age=30 Title="Manager"

# Update
az storage entity merge \
  --account-name <acc-name> \
  --table-name <t-name> \
  --auth-mode login \
  --entity PartitionKey=HR RowKey=12345 Name="John Doe" Age=30 Title="Manager"

*/delete

This would allow to delete file inside the shared filesystem which might interrupt some services or make the client lose valuable information.

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.