name: Build and deploy Python project to Azure Function App - funcGithub

on: push: branches:

• main workflow_dispatch:

env: AZURE_FUNCTIONAPP_PACKAGE_PATH: “.” # set this to the path to your web app project, defaults to the repository root PYTHON_VERSION: “3.11” # set this to the python version to use (supports 3.6, 3.7, 3.8)

jobs: build: runs-on: ubuntu-latest steps:

• name: Checkout repository uses: actions/checkout@v4

• name: Setup Python version uses: actions/setup-python@v5 with: python-version: ${{ env.PYTHON_VERSION }}

• name: Create and start virtual environment run: | python -m venv venv source venv/bin/activate

• name: Install dependencies run: pip install -r requirements.txt

Optional: Add step to run tests here

• name: Zip artifact for deployment run: zip release.zip ./* -r

• name: Upload artifact for deployment job uses: actions/upload-artifact@v4 with: name: python-app path: | release.zip !venv/

deploy: runs-on: ubuntu-latest needs: build

permissions: id-token: write #This is required for requesting the JWT

steps:

• name: Download artifact from build job uses: actions/download-artifact@v4 with: name: python-app

• name: Unzip artifact for deployment run: unzip release.zip

• name: Login to Azure uses: azure/login@v2 with: client-id: ${{ secrets.AZUREAPPSERVICE_CLIENTID_6C3396368D954957BC58E4C788D37FD1 }} tenant-id: ${{ secrets.AZUREAPPSERVICE_TENANTID_7E50AEF6222E4C3DA9272D27FB169CCD }} subscription-id: ${{ secrets.AZUREAPPSERVICE_SUBSCRIPTIONID_905358F484A74277BDC20978459F26F4 }}

• name: “Deploy to Azure Functions” uses: Azure/functions-action@v1 id: deploy-to-function with: app-name: “funcGithub” slot-name: “Production” package: ${{ env.AZURE_FUNCTIONAPP_PACKAGE_PATH }}

</details>

さらに、**Managed Identity**も作成されるため、リポジトリのGithub Actionはそれを使用してAzureにログインできるようになります。これは、**Managed Identity**上にフェデレーテッド資格情報を生成することによって行われ、**Issuer** `https://token.actions.githubusercontent.com` と **Subject Identifier** `repo:<org-name>/<repo-name>:ref:refs/heads/<branch-name>` が許可されます。

> [!CAUTION]
> したがって、そのリポジトリを侵害した者は、関数およびそれに関連付けられたManaged Identitiesを侵害することができます。

### コンテナベースのデプロイメント

すべてのプランがコンテナのデプロイを許可しているわけではありませんが、許可されているプランでは、設定にコンテナのURLが含まれます。APIでは、**`linuxFxVersion`**設定は次のようになります: `DOCKER|mcr.microsoft.com/...`、一方、ウェブコンソールでは、設定に**image settings**が表示されます。

さらに、**ソースコードは関数に関連するストレージ**アカウントに保存されることはありません。必要ないためです。

## 列挙

{{#tabs }}
{{#tab name="az cli" }}
```bash
# List all the functions
az functionapp list

# List functions in an function-app (endpoints)
az functionapp function list \
--name <app-name> \
--resource-group <res-group>

# Get details about the source of the function code
az functionapp deployment source show \
--name <app-name> \
--resource-group <res-group>
## If error like "This is currently not supported."
## Then, this is probalby using a container

# Get more info if a container is being used
az functionapp config container show \
--name <name> \
--resource-group <res-group>

# Get settings (and privesc to the sorage account)
az functionapp config appsettings list --name <app-name> --resource-group <res-group>

# Get access restrictions
az functionapp config access-restriction show --name <app-name> --resource-group <res-group>

# Check if a domain was assigned to a function app
az functionapp config hostname list --webapp-name <app-name> --resource-group <res-group>

# Get SSL certificates
az functionapp config ssl list --resource-group <res-group>

# Get network restrictions
az functionapp config access-restriction show --name <app-name> --resource-group <res-group>

# Get acess restrictions
az functionapp config access-restriction show --name <app-name> --resource-group <res-group>

# Get connection strings
az rest --method POST --uri "https://management.azure.com/subscriptions/<subscription>/resourceGroups/<res-group>/providers/Microsoft.Web/sites/<app-name>/config/connectionstrings/list?api-version=2022-03-01"
az rest --method GET --uri "https://management.azure.com/subscriptions/<subscription>/resourceGroups/<res-group>/providers/Microsoft.Web/sites/<app-name>/config/configreferences/connectionstrings?api-version=2022-03-01"

# Get SCM credentials
az functionapp deployment list-publishing-credentials --name <app-name> --resource-group <res-group>

# Get function, system and master keys
az functionapp keys list --name <app-name> --resource-group <res-group>

# Get Host key
az rest --method POST --uri "https://management.azure.com/<subscription>/resourceGroups/<res-group>/providers/Microsoft.Web/sites/<app-name>/functions/<function-endpoint-name>/listKeys?api-version=2022-03-01"

# Get source code with Master Key of the function
curl "<script_href>?code=<master-key>"
curl "https://<func-app-name>.azurewebsites.net/admin/vfs/home/site/wwwroot/function_app.py?code=<master-key>" -v

# Get source code using SCM access (Azure permissions or SCM creds)
az rest --method GET \
--url "https://<func-app-name>.azurewebsites.net/admin/vfs/home/site/wwwroot/function_app.py?code=<master-key>" \
--resource "https://management.azure.com/"

# Get source code with Azure permissions
az rest --url "https://management.azure.com/subscriptions/<subscription>/resourceGroups/<res-group>/providers/Microsoft.Web/sites/<app-name>/hostruntime/admin/vfs/function_app.py?relativePath=1&api-version=2022-03-01"
## Another example
az rest --url "https://management.azure.com/subscriptions/9291ff6e-6afb-430e-82a4-6f04b2d05c7f/resourceGroups/Resource_Group_1/providers/Microsoft.Web/sites/ConsumptionExample/hostruntime/admin/vfs/HttpExample/index.js?relativePath=1&api-version=2022-03-01"

{{#endtab }}

{{#tab name=“Az Powershell” }}

Get-Command -Module Az.Functions

# Lists all Function Apps in the current subscription or in a specific resource group.
Get-AzFunctionApp  -ResourceGroupName <String>

# Displays the regions where Azure Function Apps are available for deployment.
Get-AzFunctionAppAvailableLocation

# Retrieves details about Azure Function App plans in a subscription or resource group.
Get-AzFunctionAppPlan -ResourceGroupName <String> -Name <String>

# Retrieves the app settings for a specific Azure Function App.
Get-AzFunctionAppSetting -Name <FunctionAppName> -ResourceGroupName <ResourceGroupName>

{{#endtab }} {{#endtabs }}

権限昇格

Az - Functions App Privesc

参考文献

• https://learn.microsoft.com/en-us/azure/azure-functions/functions-openapi-definition

Tip

AWSハッキングを学び、実践する：HackTricks Training AWS Red Team Expert (ARTE)
GCPハッキングを学び、実践する：HackTricks Training GCP Red Team Expert (GRTE) Azureハッキングを学び、実践する：HackTricks Training Azure Red Team Expert (AzRTE)

HackTricksをサポートする

• サブスクリプションプランを確認してください！
• **💬 Discordグループまたはテレグラムグループに参加するか、Twitter 🐦 @hacktricks_liveをフォローしてください。
• HackTricksおよびHackTricks CloudのGitHubリポジトリにPRを提出してハッキングトリックを共有してください。