Az - Logic Apps
Reading time: 10 minutes
tip
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Support HackTricks
- Check the subscription plans!
- Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
- Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.
Basic Information
Azure Logic Apps is a cloud-based service provided by Microsoft Azure that enables developers to create and run workflows that integrate various services, data sources, and applications. These workflows are designed to automate business processes, orchestrate tasks, and perform data integrations across different platforms.
Logic Apps provides a visual designer to create workflows with a wide range of pre-built connectors, which makes it easy to connect to and interact with various services, such as Office 365, Dynamics CRM, Salesforce, and many others. You can also create custom connectors for your specific needs.
Examples
- Automating Data Pipelines: Logic Apps can automate data transfer and transformation processes in combination with Azure Data Factory. This is useful for creating scalable and reliable data pipelines that move and transform data between various data stores, like Azure SQL Database and Azure Blob Storage, aiding in analytics and business intelligence operations.
- Integrating with Azure Functions: Logic Apps can work alongside Azure Functions to develop sophisticated, event-driven applications that scale as needed and integrate seamlessly with other Azure services. An example use case is using a Logic App to trigger an Azure Function in response to certain events, such as changes in an Azure Storage account, allowing for dynamic data processing.
Visualize a LogicAPP
It's possible to view a LogicApp with graphics:
.png)
or to check the code in the "Logic app code view" section.
SSRF Protection
Even if you find the Logic App vulnerable to SSRF, you won't be able to access the credentials from the metadata as Logic Apps doesn't allow that.
For example, something like this won't return the token:
# The URL belongs to a Logic App vulenrable to SSRF
curl -XPOST 'https://prod-44.westus.logic.azure.com:443/workflows/2d8de4be6e974123adf0b98159966644/triggers/manual/paths/invoke?api-version=2016-10-01&sp=%2Ftriggers%2Fmanual%2Frun&sv=1.0&sig=_8_oqqsCXc0u2c7hNjtSZmT0uM4Xi3hktw6Uze0O34s' -d '{"url": "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"}' -H "Content-type: application/json" -v
Hosting options
There are several hosting options:
- Consumption
- Multi-tenant: provides shared compute resources, operates in the public cloud, and follows a pay-per-operation pricing model. This is ideal for lightweight and cost-effective workloads.
- Standard
- Workflow Service Plan: dedicated compute resources with VNET integration for networking and charges per workflow service plan instance. It is suitable for more demanding workloads requiring greater control.
- App Service Environment V3 dedicated compute resources with full isolation and scalability. It also integrates with VNET for networking and uses a pricing model based on App Service instances within the environment. This is ideal for enterprise-scale applications needing high isolation.
- Hybrid designed for local processing and multi-cloud support. It allows customer-managed compute resources with local network access and utilizes Kubernetes Event-Driven Autoscaling (KEDA).
Enumeration
{% tabs %} {% tab title="az cli" %} {% code overflow="wrap" %}
# List
az logic workflow list --resource-group <ResourceGroupName>
# Get info
az logic workflow show --name <LogicAppName> --resource-group <ResourceGroupName>
# Get details of a specific Logic App workflow, including its connections and parameters
az rest \
--method GET \
--uri "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Logic/workflows/{workflowName}?api-version=2016-10-01&$expand=connections.json,parameters.json" \
--headers "Content-Type=application/json"
# Get details about triggers for a specific Logic App
az rest --method GET \
--uri "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Logic/workflows/{logicAppName}/triggers?api-version=2016-06-01"
# Get the callback URL for a specific trigger in a Logic App
az rest --method POST \
--uri "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Logic/workflows/{logicAppName}/triggers/{triggerName}/listCallbackUrl?api-version=2016-06-01"
# Get the history of a specific trigger in a Logic App
az rest --method GET \
--uri "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Logic/workflows/{logicAppName}/triggers/{triggerName}/histories?api-version=2016-06-01"
# List all runs of a specific Logic App workflow
az rest \
--method GET \
--uri "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Logic/workflows/{workflowName}/runs?api-version=2016-06-01" \
--headers "Content-Type=application/json"
# Get all actions within a specific run of a Logic App workflow
az rest \
--method GET \
--uri "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Logic/workflows/{workflowName}/runs/{runName}/actions?api-version=2016-06-01" \
--headers "Content-Type=application/json"
# List all versions of a specific Logic App workflow
az rest \
--method GET \
--uri "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Logic/workflows/{workflowName}/versions?api-version=2016-06-01" \
--headers "Content-Type=application/json"
# Get details of a specific version of a Logic App workflow
az rest \
--method GET \
--uri "https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Logic/workflows/{workflowName}/versions/{versionName}?api-version=2016-06-01" \
--headers "Content-Type=application/json"
az rest \
--method GET \
--uri "https://examplelogicapp1994.scm.azurewebsites.net/api/functions/admin/download?includeCsproj=true&includeAppSettings=true" \
--headers "Content-Type=application/json"
# List all Logic Apps in the specified resource group
az logicapp list --resource-group <ResourceGroupName>
# Show detailed information about a specific Logic App
az logicapp show --name <LogicAppName> --resource-group <ResourceGroupName>
# List all application settings for a specific Logic App
az logicapp config appsettings list --name <LogicAppName> --resource-group <ResourceGroupName>
{% endcode %} {% endtab %}
{% tab title="Az PowerShell" %} {% code overflow="wrap" %}
Get-Command -Module Az.LogicApp
# List
Get-AzLogicApp -ResourceGroupName <ResourceGroupName>
# Get info
Get-AzLogicApp -ResourceGroupName <ResourceGroupName> -Name <LogicAppName>
# Get details of a specific Logic App workflow run action
Get-AzLogicAppRunAction -ResourceGroupName "<ResourceGroupName>" -Name "<LogicAppName>" -RunName "<RunName>"
# Get the run history for a specific Logic App
Get-AzLogicAppRunHistory -ResourceGroupName "<ResourceGroupName>" -Name "<LogicAppName>"
# Get details about triggers for a specific Logic App
Get-AzLogicAppTrigger -ResourceGroupName "<ResourceGroupName>" -Name "<LogicAppName>"
# Get the callback URL for a specific trigger in a Logic App
Get-AzLogicAppTriggerCallbackUrl -ResourceGroupName "<ResourceGroupName>" -LName "<LogicAppName>" -TriggerName "<TriggerName>"
# Get the history of a specific trigger in a Logic App
Get-AzLogicAppTriggerHistory -ResourceGroupName "<ResourceGroupName>" -Name "<LogicAppName>" -TriggerName "<TriggerName>"
{% endcode %} {% endtab %} {% endtabs %}
Integration Accounts
Integration Accounts, are a feature of Azure Logic Apps. Integration Accounts are used to facilitate enterprise-level integrations by enabling advanced B2B capabilities, such as EDI, AS2, and XML schema management. Integration Accounts are a container in Azure that store the following artifacts used for Logic Apps:
- Schemas: Manage XML schemas for validating and processing messages in your integration account.
- Maps: Configure XSLT-based transformations to convert data formats within your integration workflows.
- Assemblies: Manage integration account assemblies to streamline logic and data processing.
- Certificates: Handle certificates for encrypting and signing messages, ensuring secure communication.
- Partners: Manage trading partner information for B2B transactions, enabling seamless integrations.
- Agreements: Configure rules and settings for exchanging data with trading partners (e.g., EDI, AS2).
- Batch Configurations: Manage batch processing configurations to group and process messages efficiently.
- RosettaNet PIP: Configure RosettaNet Partner Interface Processes (PIPs) for standardizing B2B communication.
Enumeration
{% tabs %} {% tab title="az cli" %} {% code overflow="wrap" %}
# Integration account
az logic integration-account list --resource-group <resource-group-name>
az logic integration-account show --resource-group <resource-group-name> --name <integration-account-name>
az logic integration-account list-callback-url --resource-group <resource-group-name> --integration-account-name <integration-account-name>
# Batch-configuration
az logic integration-account batch-configuration list \
--resource-group <resource-group-name> \
--integration-account-name <integration-account-name>
az logic integration-account batch-configuration show \
--resource-group <resource-group-name> \
--integration-account-name <integration-account-name> \
--batch-configuration-name <batch-configuration-name>
# Map
az logic integration-account map list \
--resource-group <resource-group-name> \
--integration-account <integration-account-name>
az logic integration-account map show \
--resource-group <resource-group-name> \
--integration-account <integration-account-name> \
--map-name <map-name>
# Partner
az logic integration-account partner list \
--resource-group <resource-group-name> \
--integration-account <integration-account-name>
az logic integration-account partner show \
--resource-group <resource-group-name> \
--integration-account <integration-account-name> \
--name <partner-name>
# Session
az logic integration-account session list \
--resource-group <resource-group-name> \
--integration-account <integration-account-name>
az logic integration-account session show \
--resource-group <resource-group-name> \
--integration-account <integration-account-name> \
--name <session-name>
# Assembly
# Session
az logic integration-account assembly list \
--resource-group <resource-group-name> \
--integration-account <integration-account-name>
az logic integration-account assembly show \
--resource-group <resource-group-name> \
--integration-account <integration-account-name> \
--assembly-artifact-name <assembly-name>
{% endcode %} {% endtab %}
{% tab title="Az PowerShell" %} {% code overflow="wrap" %}
Get-Command -Module Az.LogicApp
# Retrieve details of an integration account
Get-AzIntegrationAccount -ResourceGroupName <resource-group-name> -Name <integration-account-name>
# Retrieve the callback URL of an integration account
Get-AzIntegrationAccountCallbackUrl -ResourceGroupName <resource-group-name> -IntegrationAccountName <integration-account-name>
# Retrieve details of a specific agreement in an integration account
Get-AzIntegrationAccountAgreement -ResourceGroupName <resource-group-name> -IntegrationAccountName <integration-account-name> -Name <agreement-name>
# Retrieve details of a specific assembly in an integration account
Get-AzIntegrationAccountAssembly -ResourceGroupName <resource-group-name> -IntegrationAccountName <integration-account-name> -Name <assembly-name>
# Retrieve details of a specific batch configuration in an integration account
Get-AzIntegrationAccountBatchConfiguration -ResourceGroupName <resource-group-name> -IntegrationAccountName <integration-account-name> -Name <batch-configuration-name>
# Retrieve details of a specific certificate in an integration account
Get-AzIntegrationAccountCertificate -ResourceGroupName <resource-group-name> -IntegrationAccountName <integration-account-name> -Name <certificate-name>
# Retrieve details of a specific map in an integration account
Get-AzIntegrationAccountMap -ResourceGroupName <resource-group-name> -IntegrationAccountName <integration-account-name> -Name <map-name>
# Retrieve details of a specific partner in an integration account
Get-AzIntegrationAccountPartner -ResourceGroupName <resource-group-name> -IntegrationAccountName <integration-account-name> -Name <partner-name>
# Retrieve details of a specific schema in an integration account
Get-AzIntegrationAccountSchema -ResourceGroupName <resource-group-name> -IntegrationAccountName <integration-account-name> -Name <schema-name>
{% endcode %} {% endtab %} {% endtabs %}
Privilege Escalation
Same as logic apps privesc:
{% content-ref url="../az-privilege-escalation/az-logic-apps-privesc.md" %} az-logic-apps-privesc.md {% endcontent-ref %}
Post Exploitation
{% content-ref url="../az-post-exploitation/az-logic-apps-post-exploitation.md" %} az-logic-apps-post-exploitation.md {% endcontent-ref %}
{% hint style="success" %}
Learn & practice AWS Hacking:HackTricks Training AWS Red Team Expert (ARTE)
Learn & practice GCP Hacking: HackTricks Training GCP Red Team Expert (GRTE)
Support HackTricks
- Check the subscription plans!
- Join the 💬 Discord group or the telegram group or follow us on Twitter 🐦 @hacktricks_live.
- Share hacking tricks by submitting PRs to the HackTricks and HackTricks Cloud github repos.