Az - File Share Post Exploitation

Reading time: 2 minutes

File Share Post Exploitation

For more information about file shares check:

Az - File Shares

Microsoft.Storage/storageAccounts/fileServices/fileshares/files/read

A principal with this permission will be able to list the files inside a file share and download the files which might contain sensitive information.

# List files inside an azure file share
az storage file list \
    --account-name <name> \
    --share-name <share-name> \
    --auth-mode login --enable-file-backup-request-intent

# Download an specific file
az storage file download \
    --account-name <name> \
    --share-name <share-name> \
    --path <filename-to-download> \
    --dest /path/to/down \
    --auth-mode login --enable-file-backup-request-intent

Microsoft.Storage/storageAccounts/fileServices/fileshares/files/write, Microsoft.Storage/storageAccounts/fileServices/writeFileBackupSemantics/action

A principal with this permission will be able to write and overwrite files in file shares which might allow him to cause some damage or even escalate privileges (e.g. overwrite some code stored in a file share):

az storage blob upload \
  --account-name <acc-name> \
  --container-name <container-name> \
  --file /tmp/up.txt --auth-mode login --overwrite

*/delete

This would allow to delete file inside the shared filesystem which might interrupt some services or make the client lose valuable information.