Az - Azure App Service & Function Apps

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Check the subscription plans!

• Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.

• Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.

App Service Basic Information

From the docs: Azure App Service ni huduma ya HTTP kwa ajili ya kuendesha programu za wavuti, REST APIs, na nyuma za simu. Unaweza kuendeleza kwa lugha unayopenda, iwe ni .NET, .NET Core, Java, Ruby, Node.js, PHP, au Python. Programu zinaendesha na kupanuka kwa urahisi katika mazingira ya Windows na Linux.

Kila programu inafanya kazi ndani ya sandbox lakini kutengwa kunategemea mipango ya App Service

• Programu katika ngazi za Bure na Kushiriki zinaendesha kwenye VMs zinazoshirikiwa

• Programu katika ngazi za Kawaida na Premium zinaendesha kwenye VMs zilizotengwa

Note that none of those isolations prevents other common web vulnerabilities (such as file upload, or injections). And if a management identity is used, it could be able to compromise its permissions.

Enumeration

az

# List webapps
az webapp list

## Less information
az webapp list --query "[].{hostName: defaultHostName, state: state, name: name, resourcegroup: resourceGroup}"

# Get access restrictions
az webapp config access-restriction show --resource-group <res-group> -n <name>

# Remove access restrictions
az webapp config access-restriction remove --resource-group <res-group> -n <name> --rule-name <rule-name>

# Get snapshots
az webapp config snapshot list --resource-group <res-group> -n <name>

# Restore snapshot
az webapp config snapshot restore -g <res-group> -n <name> --time 2018-12-11T23:34:16.8388367

# Restart webapp
az webapp restart --name <name> --resource-group <res-group>

Az Powershell

# Get App Services and Function Apps
Get-AzWebApp
# Get only App Services
Get-AzWebApp | ?{$_.Kind -notmatch "functionapp"}

az pata yote

#!/bin/bash

# Get all App Service and Function Apps

# Define Azure subscription ID
azure_subscription="your_subscription_id"

# Log in to Azure
az login

# Select Azure subscription
az account set --subscription $azure_subscription

# Get all App Services in the specified subscription
list_app_services=$(az appservice list --query "[].{appServiceName: name, group: resourceGroup}" -o tsv)

# Iterate over each App Service
echo "$list_app_services" | while IFS=$'\t' read -r appServiceName group; do
# Get the type of the App Service
service_type=$(az appservice show --name $appServiceName --resource-group $group --query "kind" -o tsv)

# Check if it is a Function App and print its name
if [ "$service_type" == "functionapp" ]; then
echo "Function App Name: $appServiceName"
fi
done

Pata akreditivu na kupata ufikiaji wa msimbo wa wavuti

# Get connection strings that could contain credentials (with DBs for example)
az webapp config connection-string list --name <name> --resource-group <res-group>
## Check how to use the DBs connection strings in the SQL page

# Get credentials to access the code and DB credentials if configured.
az webapp deployment list-publishing-profiles --resource-group <res-group> -n <name>


# Get git URL to access the code
az webapp deployment source config-local-git --resource-group <res-group> -n <name>

# Access/Modify the code via git
git clone 'https://<username>:<password>@name.scm.azurewebsites.net/repo-name.git'
## In my case the username was: $nameofthewebapp and the password some random chars
## If you change the code and do a push, the app is automatically redeployed

Upatikanaji wa kontena la Docker na webapp kupitia ssh:

# Get ssh session
az webapp create-remote-connection --subscription <SUBSCRIPTION-ID> --resource-group <RG-NAME> -n <APP-SERVICE-NAME>

## If successfull you will get a message such as:
#Verifying if app is running....
#App is running. Trying to establish tunnel connection...
#Opening tunnel on port: 39895
#SSH is available { username: root, password: Docker! }

## So from that machine ssh into that port (you might need generate a new ssh session to the jump host)
ssh root@127.0.0.1 -p 39895

Function Apps Basic Information

Azure Functions ni suluhisho la serverless linalokuruhusu kuandika msimbo kidogo, kudumisha miundombinu kidogo, na kuokoa gharama. Badala ya kuwa na wasiwasi kuhusu kupeleka na kudumisha seva, miundombinu ya wingu inatoa rasilimali zote za kisasa zinazohitajika ili kuweka programu zako zikifanya kazi.

Katika lango la Azure, uunganisho kati ya Azure Functions na Azure API Management unarahisishwa, ukiruhusu HTTP trigger function endpoints kuonyeshwa kama REST APIs. APIs zinazonyeshwa kwa njia hii zinaelezewa kwa kutumia ufafanuzi wa OpenAPI, ukitoa kiolesura cha kawaida, kisicho na lugha kwa APIs za RESTful.

Function Apps inasaidia Identiti Zinazosimamiwa.

Zaidi ya hayo, Function App inaweza kuwa na baadhi ya endpoints ambazo zinahitaji kiwango fulani cha uthibitisho, kama vile "admin" au "anonymous". Mshambuliaji anaweza kujaribu kufikia anonymous allowed endpoints ili kupita vizuizi na kupata ufikiaji wa data nyeti au kazi.

Enumeration

# Get only Function Apps
Get-AzFunctionApp

References

• https://learn.microsoft.com/en-in/azure/app-service/overview

• https://learn.microsoft.com/en-us/azure/azure-functions/functions-openapi-definition

Jifunze na fanya mazoezi ya AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE) Jifunze na fanya mazoezi ya GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)

Support HackTricks

• Angalia mpango wa usajili!

• Jiunge na 💬 kikundi cha Discord au kikundi cha telegram au tufuatilie kwenye Twitter 🐦 @hacktricks_live.

• Shiriki mbinu za hacking kwa kuwasilisha PRs kwa HackTricks na HackTricks Cloud repos za github.