Az - Blob Storage Post Exploitation

Reading time: 2 minutes

Storage Privesc

For more information about storage check:

Az - Storage Accounts & Blobs

Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read

A principal with this permission will be able to list the blobs (files) inside a container and download the files which might contain sensitive information.

# e.g. Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read
az storage blob list \
  --account-name <acc-name> \
  --container-name <container-name> --auth-mode login

az storage blob download \
  --account-name <acc-name> \
  --container-name <container-name> \
  -n file.txt --auth-mode login

Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write

A principal with this permission will be able to write and overwrite files in containers which might allow him to cause some damage or even escalate privileges (e.g. overwrite some code stored in a blob):

# e.g. Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write
az storage blob upload \
  --account-name <acc-name> \
  --container-name <container-name> \
  --file /tmp/up.txt --auth-mode login --overwrite

*/delete

This would allow to delete objects inside the storage account which might interrupt some services or make the client lose valuable information.